`isCredentialsAllowed()`?