use string-only comparison for password in webpass, and trim file_get_contents results