I think it would be more robust to `JSON.decode()` inside a `try-catch` at the very top of the closure, without even checking `value != null` and nullify user/password in the `catch`.