ok, we do need a separate password setting process