[security-dev] Supporting different credential types from a single authentication endpoint