avoid pitfalls of using withCredentials in the test