now handle passwords