hidden extra field on password