Currently Credentials related APIs use username to specify actual credential ID ("app id" of sorts). Refactoring username will help avoid confusion with what-is-what (for example from repo.getCredentials(jid, username); it's not immediately clear).