users have default password of password