moved user_command parsing out of creds, so that we can pass it via soap without issues