Disable credentials if calling from loopback

Signed-off-by: Tom Wright <tom@inflatablecookie.com>