If its simpler, then I agree it can stay for a while, however, please can we allow for the spa login returning a credentials blob and having that stored as well? I think this will fit better with the intended api.