internal server error should be checked after credentials