do not expose password in logs