http: use credential API to get passwords