Credentials was an instance of UserPassword in the case of HTTP Basic auth, so there was no blob attribute. So this check would then fail in an AttributeError indeed.