promote all low-level authentication stuff to system/default handler