remove hard coded creds