rewrite credential check to use HTTP parameters