don't get credentials for requests until we are sure they are needed (i.e. not cached)