remove hardcode username, password