Security fix: possible password hijacking