make sure create_cracked_credential always returns

always return the newly created core