Generally, it is not a good idea to set eraseCredentials to false and we should document this in the javadoc