Turn omit credentials into a mode rather than a flag to cater to "anonymous" requests.