* code cleanup: use password variable sent by caller, not the $_POST one