don't hardcode db password