logging password is only ok on dev machine