added note that pw supplied is not stored securely for users