I think we lose too much information here : if we have a ```UsernamePasswordCredentials```, it will become a ```BasicCredentialMetaData``` with just the class type saved : why not keeping the username provided ? I'm wondering if the *credentials* shouldn't be able to return their own metadata through a ```getMetaData()``` method for example providing a safe ```UsernamePasswordCredentials``` in this case with the password erased...