now things are relatively more secure and still don't use pass.js