all routes will use default user and password