fix init so it generates new creds, and serve so it does not