more password auth in packages