Hmm, I just realized, we probably want to send the credentials to the browser after logging in.