I'm wondering if this shouldn't just be a parameter instead of reading a file on the system / hardcoded values. Maybe parameter with a fallback to settings and otherwise error out, but I think we should not make it easy to use the default username/password combo.