replace password placeholders