credentials stored in session storage