```
        var url = string.Format("{0}?userid={1}&password ={2}", rootUrl, Id,password);

        //use ClientScript to open a new windows from server side
        var sb = new StringBuilder();
        sb.Append("<script type = 'text/javascript'>");
        sb.Append("window.open('");
        sb.Append(url);
        sb.Append("');");
        sb.Append("</script>");
        ClientScript.RegisterStartupScript(this.GetType(), "script", sb.ToString());

```

I don't want to userid and password display in url.