move secret to private repo
hide username and password on login page