bugfix: password should be in crypted