bump DEFAULT_CREDENTIAL_LIFETIME to 31 days, to make renew work