move password to env