add credential helper with a 1 hour timeout