credential cleanup