r9500: userAuth() takes a creds object, not a general object now ...