hiding credentials in application.yml