Pass credentials as well (needed for the ajax workaround)

Not sure if this'll work, but since we're only looking at the keys to filter, this might also work (but might not because `dir(o)` isn't always the same thing as `vars(o).keys()`):

```python
filter_func = lambda key: isinstance(key, basestring) and not key.startswith('_')
fields = filter(filter_func, dir(o)))
return {k:getattr(o, k) for k in fields if hasattr(o, k)}
```

But I think I hate this idea.