use anonymous UAM if no user/password provided in connection request