Security fix - remove user credentials from URL parameters.