username and password only make sense together, use Credentials case class