Move Oper pass to credentials.
Mark other services as restricted.