More a reminder: we need method for other mechanism as well - like read user from environment (where apache does the auth) or some token based mechanism like OAuth.