work in progress
password on user-creation, write-only