I wonder whether we should hold off on saving the credentials until we know they're good. (This is more important when `store` is more permanent.)