milestone: refactor TLS anon credentials handling