re-encrypt creds