True, but if going to use the `auth` param anywhere in demands, then I suggest we take out username & password altogether.  If someone wants to configure the service with auth, use the `auth` param.