allow setting endpoint without trampling credentials