move cache logic around to only require sso if no creds are provided