only warn about invalid credentials