storing + producing credentials in the session