From section 4.2.1.2.1: DataLocations/Credentials element I think this is a good choice to include a Credentials element
 nested in the DataLocations element of the DataEPR. Ideally though, I would have a default Credentials element 
elsewhere that could apply to both the source and sink DEPRs, perhaps in the [transfer requirements] parameter of the 
create DTI call. I think it’s likely that the user’s credential often will be the same for source and sink. By only 
having this element nested within the source and sink DEPRs results in significant overhead.