We need to relax this requirement and let the client decides if it can allow to set credentials API over plain connection.
Setting credentials doesn't belong to service management API anymore.