Allow placing credentials in injected request.

- allows for bypassing of authentication handlers
- can place any object in credentials property
`.not.to.have.property("credentials")` would more closely model the intended result here.