remove hardcoded credentials