Don't call credentials_headers() twice

We don't need to call credentials_headers in the stack create/update
code, as it's already called in the HTTPClient.  This has the side-
effect of simplifying the shell test, which currently has to mock
header arguments to json_request, which are incorrect anyway because
HTTPClient always sets X-Auth-Token if a token is passed in (as
evidenced by bug #1250731)

Change-Id: I6212cf5a50f5a8d919f743e23ece4bd1d0e1ad1c
Partial-Bug: #1252248