use explicit sandbox credentials for figshare auth in vignette too