Is setting eraseCredentials to false considered bad practice or in any way insecure in Spring Security?

I've been using the Spring Security framework for the past week, trying to incorporate a custom authentication provider into my application that delegates authentication requests to a third-party, which returns an access token along with a refresh token.

I've implemented the functionality and it works nicely, however I stumbled onto a 'problem'.

My authentication provider maps the token pair to the credentials object of an UsernamePasswordAuthenticationToken and returns this token inside the authenticate method. In pseudocode:

public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        User user = getUser(authentication.getPrincipal());
        Tokens tokens = getTokens(u, authentication.getCredentials());
        List<SimpleGrantedAuthority> authorities = ...
        return new UsernamePasswordAuthenticationToken(user, tokens, authorities);
    }
}

I can then register my authentication provider inside my application context by associating it to the authentication manager:

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(netFAuthenticationProvider);
}

The returned authentication token is persisted into the security context of my web application and can be accessed from my controllers.

According to the java documentation, Spring Security persists the returned UsernamePasswordAuthenticationToken into the SecurityContext. However, the credentials (in this case, the tokens) are removed from the Authentication object, which prevents me from using them inside my controllers. This is very restrictive, since I need the tokens to issue requests to the third-party system. A simple workaround is to explicitly tell Spring Security that the credentials are not to be removed, like this:

 @Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(netFAuthenticationProvider).eraseCredentials(false);
}

Is this somewhat non-secure or considered bad practice? My assumption is that it would be bad practice if the credentials were actually a non-encrypted password. However, this is a token. I cannot introspect the token to obtain some kind of sensitive information. Yes, I can decode the token, but it does not contain any kind of sensible information about the user.