tweak password logic [ci skip]