check_credentials does not use a constant time string comparison method.
This behaviour is unsafe and i think it could lead in a potential timing attack