salt/password should be there (never)