Rewrite credentials section - favour session token

Now that it is possible not to save the password we really should not be recommending it.