make things more secure for now.  bind with the authenticating user's credentials