refactoring password