handle undefined credential more gracefully