Again, it would be nice to leave this up to the external auth provider.