remove username:password from url