move credential revocation code to vccs module