In favour of `credentials` callback. Only called at request time, and can be overridden by optional property.