fixed credential input; only shows when not auth'd