look for a delegate cred from user before using server's cred