bug-1311125: hide App manager's password before returning to the client