1.3 - tweaked the credentials supplier

• Version 1.2 introduced breaking changes on the credentials supplier.
• Version 1.3 adds a bit of clarification to it: the credentials supplier must always return something, never null. It can return Credentials.invalidCredentials() if needed.