remove username and password from challenge costs api