made pw field secret, fixed mismatches in GET/POST routes