pwd protection - incomplete