corrected but that permitted secrets w/o username and password