credentials: Only do shallow copies of valid ccaches