update jaoss submodule reference
suggest that sensitive credentials are stored in env vars