obscuring credentials throughout appcontroller