credential-handlers is completely untested