prevent app_get_pass() from revealing cleartext password on syntax error