blank credentials could be ok