fixed username and password handling