harden everything around passwords