We should update nullability annotations for `TestingAuthenticationToken.credentials` to allow `null`