ref #7 changed form field types to password