passwords and file uploads