password auth and readonly toggle