add credentials_in_request_body hint in SURFconext config