paramater checking for src_cred, and allow src_cred to be none when getting rights...