allow username/password auth