Two thoughts:

 * Lots of duplication here; any reason we can't collapse it?
 * Should some/all of this code live on the classes for the credentials they create?