Moves from 'tokens' to 'credentials', keeps access_token up to date