fix: log username/password only in DEBUG