In a future commit, we're going to be accessing credential handling from
multiple packages. To avoid an import loop, move credential handling
into its own package. Update all the callers of the credential handling
code to use a qualified name.
Where there is a local variable called "creds", which would conflict
with our package name, rename it "cred" instead.