pulled password config into security.inc