actually send credentials