fix security issue with username and password being sent in the url as params, which end up in the log files