move check_credentials to method