remove username & password from URL before doing request (thanks @hodgestar)