add note about password