fully implemented passwords (hopefully)