credentials are contain in the cookie, for now