allow password to be ENV varible