stop email+password being added to callback URL

previously these values were being added to the URL so they appeared on
the wire and in logs