Add /session/credentials route