Locking refresh of credentials

Fixes #26