Patch Set 3: I would prefer that you didn't submit this

(14 inline comments)

verified successfully, but some room for improvements

maybe we should add a test with wrong credentials to prove that authentication is really used