Instantiating Credential objects with string param is not safe when arg is unknown...