remove hard-coded credentials