added password client middleware