exposing Username and Password via ENV