add password field in settings

if it's not protected, and we use the password, the database will still
be opened.