fix: pass only one password to server

fix #5