updated with SecureString