don't echo back a password in the error message