Reduce contention while acquiring credentials

[Ankur Goyal (ankrgyl)]

• Don't hold the lock while awaiting new credentials. It can sometimes take a long time (like a minute)
• Use a stale-while-revalidate pattern, so we do not block concurrent requests while refetching credentials