why is user password removed but username not? We should either have both or none.