Allow placing credentials in injected request.

- allows for bypassing of authentication handlers
- can place any object in credentials property
Good catch.