move password setting out of server script