fixed: set default password as string