I wonder if we should create a new block instead of using an old here?

Also, I'd like to see documentation in the header file that states if a user sets this block, they are responsible for the delegate callback implementation.

This is the documentation from apple:

>In this method,you must invoke one of the challenge-responder methods (NSURLAuthenticationChallengeSender protocol):
 * useCredential:forAuthenticationChallenge:
 * continueWithoutCredentialForAuthenticationChallenge:
 * cancelAuthenticationChallenge:
 * performDefaultHandlingForAuthenticationChallenge:
 * rejectProtectionSpaceAndContinueWithChallenge:
>
>You might also want to analyze challenge for the authentication scheme and the proposed credential before calling a NSURLAuthenticationChallengeSender method. You should never assume that a proposed credential is present. You can either create your own credential and respond with that, or you can send the proposed credential back. (Because this object is immutable, if you want to change it you must copy it and then modify the copy.)