Probably better to only pass the credentials if `username` and `password` are present?