put password in double quote, to allow substitution