add password requirement to save state
make state functions restful