add password bearer token handling