Refactor a bit.
Simplify/clarify
Try to use a single self-access credential once more.