my rationale: this will probably end up being a case statement switching on mechanism after we add support for other auth types here.