fix logic of when to get a username/password and when not to