credentials are contains in the cookie, for now