client's password as param