put credential to req.locals