use username and password directly when download states