removing username and pw from request