Right now, we're passing in the username and password as config parameters which is fine for playing around but not for a production environment. See `DefaultSqlBackedClient`