server: rename password fields to make more sense