fixed 'source' object in verify_credentials