[!!!][BUGFIX] Avoid Credentials to be stored in the request
When you authenticate using the PersistedUsernamePasswordProvider
username & password are copied to the GET Arguments of the following
request when used in SubRequests (plugins / widgets) because POST
arguments are merged in the RequestBuilder.
This change fixes this by prepending username & password with two
underscores, turning them into "internal request arguments" (see #25802)