[config] keep username and secret in config file.