AUTH_CLEAR is really misleading. It suggest that authentication is cleared. But it is set but as a PLAIN text.