AbstractAuthHandler could be better.