allow hidden passwords (those beginning with an underscore)
new client: web CGI