remove http basic auth and use a random URL instead. fixes #2