username and passwords are read from config