enable anonymous rest calls, clean up credentials handling (credentials drop-down still ignored, why?);