need to allow widgets explicitly if password protected