Add documentation on credentials for actions and fields

See discussion in #567