initial
done with dumb password