Why is the credentials code in `transport.go`?