persistent sessions and credentials