fix(app.json): correct setting for password