prompt for credentials if necessary