Pass credentials as well (needed for the ajax workaround)

Seems to be throwing out the baby with the bath, then, no? If one key in the object __dict__ isn't a string, the whole thing gets rejected? This probably need to be unrolled just a little bit.

```python
# We could potentially just str(key).startswith rather than check type, but then one of the
# "public fields" might well be named "None", for example
filter_func = lambda item: isinstance(item[0], basestring) and not item[0].startswith('_')
return dict(filter(filter_func, vars(o).items()))
```