remove: 'username' & 'password' from DefaultJRAuth .