fix: add default password