Allow placing credentials in injected request.

- allows for bypassing of authentication handlers
- can place any object in credentials property
I didn't keep this because adding a method like ```clear``` to the API isn't as clean.