userames and passwords are now parameters in users.xml parsed at initialisation