I want to call attention to this bit right here. Once auth gets to this level (i.e., we've already gotten a 401 once), this is how the overrides work. The credentials in the payload **always** win if they're present.