I'm not too enthusiastic about jumping through `get_field_values()` twice. Since we're already pulling the auth params directly out of the request object, maybe we can just return `False` from `is_authenticated()` if either field is missing or something?