username, password removed from constructor