Other than schlepping usernames and passwords across the Internet as environment variables what would you recommend as a security best practice?