password cloaked still need to doGET requests from form