[SECURITY-869] Associate the delegated credential with the request instead of using a session, this avoids creating a new session when we don't need one.