more robust authentication helpers, so that final instance fields username and password can avoid being set if not required to