password field in parameters gets an empty string