remove auth_cache; set password invisible