rolled back ugly workaround for password masking