load passwords from external config