use https authentication instead
minor tweak to assert stmt