Within the client security policy, the credential extraction method is set to Form.Which statement is a requirement in this case?