don't show password as plain text