Fetch credentials endpoint correctly

This fixes issue #14 by first fetching the location where
the credentials are served, and then fetching that location.