credential sniffing.  need to fix xhr later...