now masking password properties; other misc cleanups