place all sensitive information in _config.php