actually cleanup url authentication