no user password in logs, copy of self.auth avoid overwrite