RequestCredentialsHandler creates its own token now. Fixes #71.