Allow the user to specify an NSURLSessionAuthChallengeDisposition, so the credential isn't ignored