add asterisks for password