mask the password field (secret -> *****)