Use a callback that checks the username/password combo instead of a
single valid combination. This allows to use HTTP basic auth against an
external user database.