updated Auth to take credentials as single string