also mention SurveyMonkey as requiring credentials_in_request_body AS