credential handling practices