remove hard-coded password