move credentials into local configuration file so they are hidden from the properties endpoint