never persist login credentials