How about "may be authenticated".  An implementation that ignores credentials that fail to authenticate when other sufficient credentials succeed is plausible?