add password advice, fix #24