don't include username or password in url when using curl