password entry is now enforced with warnings