don't store password in clear text