password is stored in plain text