add encrypting password;
refactor auth and request mechanism;