How do we apply the token to outgoing requests?  Does this need to be configurable inside the credential class?