It seems that the user credentials that are used to connect to xnat, are visible in the public web interface. (I.e., when visiting as guest.)  Thanks in advance for fixing. Paul