added extra credentials such that clients can make use of original username/password or extracredentials to authorize