Make requested credentials a top-level bitflags field