Credentials fixes

* update URNs
* don't require oauth to fetch root document
* use auth links for credentials endpoints (there's currently not a "list-creds" link though ... maybe that should be added at some point)