protect login search from sql injection too :mask:
remove find by password from credential controller :exclamation: