don't expose RCS password to the session