credential store refactor