don't do anything unless credentials supplied