gross hack of user and password with env var