mostly for ease of implementation but does mean we don't have username/password secrets on the command line