rework the password subsystem