obfuscate user and password