remove hardcoded devel-password from client