moved _current_oe_credentials to AbstractController for more reuse