Credentials not removed from base_url when using 'session'

Not harmful (i think) but not correct