complete rewrite of credential storage