actually moving password to env variable