Function may_hold_credential 

pub(crate) fn may_hold_credential(api: &str) -> bool

Whether a bearer token may be sent to this node without being asked for by name.

Loopback, or the node .choir/config points at. An explicit --auth-file is the reader saying which credential goes where and is never second-guessed; this is only about the implicit one, and an implicit credential must not follow a URL that merely happened to be typed after a command that takes one.