allow app-specific credentialling.  also, fix a subtle bug in the client
when the server hangs up before replying...