refactor password to env variable