pushing user creds to browser