would it be so wrong to call them username / password ?