prompt: ask username and pw separately