moved passwords to env vars