auth/credentials: if credentials have principal set, they are not anonymous anymore