diff --git a/coreapi/transports/http.py b/coreapi/transports/http.py
index a548024..2ee3337 100644
--- a/coreapi/transports/http.py
+++ b/coreapi/transports/http.py
@@ -339,17 +339,17 @@ class HTTPTransport(BaseTransport):
             headers = {key.lower(): value for key, value in headers.items()}
         if session is None:
             session = requests.Session()
-        if auth is not None:
-            session.auth = auth
-        if not getattr(session.auth, 'allow_cookies', False):
-            session.cookies.set_policy(BlockAll())
-
         if credentials is not None:
             warnings.warn(
                 "The 'credentials' argument is now deprecated in favor of 'auth'.",
                 DeprecationWarning
             )
-            auth = DomainCredentials(credentials)
+            session.auth = DomainCredentials(credentials)
+        if auth is not None:
+            session.auth = auth
+        if not getattr(session.auth, 'allow_cookies', False):
+            session.cookies.set_policy(BlockAll())
+
         if request_callback is not None or response_callback is not None:
             warnings.warn(
                 "The 'request_callback' and 'response_callback' arguments are now deprecated. "