protected function parseAllowCredentials(ServerRequestInterface $request) : bool
    {
        // read in the current setting
        $item = $this->settings['allowCredentials'];
        // we allow callables to be set (along with strings) so we can vary things upon requests.
        if (true === is_callable($item)) {
            // all callbacks are made with the request as the second parameter.
            $item = call_user_func($item, $request);
        }

        // if the credentials are still not a boolean, abort.
        if (false === is_bool($item)) {
            throw new \InvalidArgumentException('allowCredentials should be a boolean value');
        }

        // return the boolean credentials setting
        return $item;
    }