doh! credentials already live in the extension object