Do not call getCredentials() if Action is not 'secure', closes #1400