allow different sources for REST API & Admin UI username/password, since node attributes are not secure