fixes #9 - setCredentials() now allows authenticated resource to set its credentials without explicit permission; and adds test cases
updates setCredentials() to throw an exception when called while impersonating another resource, and adds test case