diff --git a/libebackend/e-collection-backend.c b/libebackend/e-collection-backend.c
index 36c02f9..e0769c8 100644
--- a/libebackend/e-collection-backend.c
+++ b/libebackend/e-collection-backend.c
@@ -1754,6 +1754,7 @@ e_collection_backend_authenticate_children (ECollectionBackend *backend,
 		}
 	}
 
+	g_list_free_full (sources, g_object_unref);
 	g_clear_object (&credentials_provider);
 	g_clear_object (&registry_server);
 }
diff --git a/libedataserver/e-source-webdav.c b/libedataserver/e-source-webdav.c
index 8b38de9..fd31993 100644
--- a/libedataserver/e-source-webdav.c
+++ b/libedataserver/e-source-webdav.c
@@ -170,9 +170,14 @@ source_webdav_update_properties_from_soup_uri (ESourceWebdav *webdav_extension)
 		extension,
 		"host", soup_uri->host,
 		"port", soup_uri->port,
-		"user", soup_uri->user,
 		NULL);
 
+	if (soup_uri->user && *soup_uri->user)
+		g_object_set (
+			extension,
+			"user", soup_uri->user,
+			NULL);
+
 	extension_name = E_SOURCE_EXTENSION_SECURITY;
 	extension = e_source_get_extension (source, extension_name);
 
diff --git a/libedataserver/e-source.c b/libedataserver/e-source.c
index ad68a64..0106bd5 100644
--- a/libedataserver/e-source.c
+++ b/libedataserver/e-source.c
@@ -937,6 +937,9 @@ source_parse_dbus_data (ESource *source,
 	gchar *data;
 	gboolean success;
 
+	if (!source->priv->dbus_object)
+		return FALSE;
+
 	dbus_object = E_DBUS_OBJECT (source->priv->dbus_object);
 
 	dbus_source = e_dbus_object_get_source (dbus_object);
diff --git a/modules/gnome-online-accounts/e-goa-password-based.c b/modules/gnome-online-accounts/e-goa-password-based.c
index 827c767..70f2c7f 100644
--- a/modules/gnome-online-accounts/e-goa-password-based.c
+++ b/modules/gnome-online-accounts/e-goa-password-based.c
@@ -217,8 +217,12 @@ e_goa_password_based_lookup_sync (ESourceCredentialsProviderImpl *provider_impl,
 	goa_account = goa_object_get_account (goa_object);
 	goa_password_based = goa_object_get_password_based (goa_object);
 
-	/* XXX We should only be here if the account is password based. */
-	g_return_val_if_fail (goa_password_based != NULL, FALSE);
+	if (!goa_password_based) {
+		/* Can be OAuth/2 based, thus return empty credentials. */
+		*out_credentials = e_named_parameters_new ();
+		success = TRUE;
+		goto exit;
+	}
 
 	success = goa_account_call_ensure_credentials_sync (
 		goa_account, NULL, cancellable, error);
