using string instead of securestring for simplicity