change to use user/pass because tarballs are not api....