use existing resolved cred if present
don't leak identity on reauth retry