So make `$username` and `$password` strings and non-optional?  Doing so would require overriding `_findUser()` in `DigestAuthenticate`.

Or make `$username` and `$password` strings but keep `$password` optional thereby just result the find's result and skip password checking and `DigestAuthenticate` stays pretty much the same as now.