don't mask password

the password is only used for changing the password (not displaying it),
so don't bother masking it