move password to a environment variable