added password requirement to list route