removed a security problem, make password settable