fix #2: support password