Credentials and CredentialStorage now requires the HTTP response to be passed into save() and delete(), which will make controllers cleaner and not have to know as much about the inner workings of credential storages