Split most of checkCredentials into a new method, performLogin, so you
can login without having to checkCredentials (!)