Bugfix: Restrict repo credential lookup to known keys.

The last test in that set is a regression test discovered while working
on #949.