Allow placing credentials in injected request.

- allows for bypassing of authentication handlers
- can place any object in credentials property
Having a public method that sets a public attribute on the browser object strikes me as a bit redundant. With this approach I could just as easily do something like `browser.credentials = { . . . }` instead of calling `browser.setCredentials({. . .})`. What do you think about making the credentials config private to the embalm scope? This would reduce clutter on the browser namespace.