externalize userids and passwords