credential: correct order of parameters for credential_match