passwords, with tests