move mos credential checking to lib