place all sensitive information in _config.php
for production environment