We need to relax this requirement and let the client decides if it can allow to set credentials API over plain connection.