fix for btoa, exposed password credentials