idlock and clarifying the responsibilities for credentials matchers