remove hardcoded passwords