fix verifyCredentials() bug