Backport authentication security fixes to 4.0