remove credentials from request data