added note on credentials