using user & password for auth (for password managers in browsers)