add override_check_credentials() so developer can implement his own authentication logic.