using a filter to lock down parts of the app
removing password from views
before update, encode the password