don't html escape strings in credentials module.