fixed not hardcoding password