web service security added, but still username and pwds are hardcoded