hardcoded username /password removed