Allowed credential types should be a bitfield

Obsoletes #1853.