add _ to password urls. some naming cleanup.