s4-auth: Make sure we use the correct credential state.