backport authentication improvements in upstream v2.4

fixes #527