It looks as if 'notUsingAuth' should also be set here, and below?
Although, I don't understand what should happen if the authenticator returns empty when there is an AUTH element in the capabilities...