very simple (and inefficient) http auth implementation

A user backend which implements IApacheBackend. It just checks REMOTE_USER and trusts that the server has authenticated the given user ID. When used with mod_auth_kerb this is very inefficient; I'm having trouble working out a sensible way to make it more efficient with OC's design of absolutely everything being routed through index.php.

Not implemented as an app because, well...I could say because this kinda feels like something that should be available in core to me, but I'd be lying if I didn't say it's at least 50% because I couldn't be bothered setting up the 'developer environment'.

This is much more of a 'tell me how to make this better' than a 'please merge this'. What I'd *like* is to be able to run the actual check-whether-user-is-identified logic in a file other than index.php , so that the server can just authenticate access to that file, not the whole of OC. But the hooks OC has set up for doing "Apache" auth just do not seem at all conducive to this (I have this crazy scheme in my head where isSessionActive() checks for a cookie and if it's not set redirects to another page which checks REMOTE_USER and if it's set performs an OC session initialization and sets the cookie, and getCurrentUserId() just doesn't really matter any more, but that just seems wrong?)

Right now this works fine (with FreeIPA, Apache and Kerberos negotiate / password auth, anyway, which is what I'm testing) but requires you to set server authentication on pretty much all of OC, so every request gets sent twice if you use mod_auth_kerb. (Well, logout doesn't work, but I wasn't focusing on that yet.)

It'd really help if I could see how the hell the code that was written to plug into these hooks works, because I have a feeling I'm missing something...
yeah, that's exactly what happens, it didn't actually matter hugely for my purposes so I didn't worry about it too much. I believe there are kinda ways to do it, but before I got too far into looking into it I got rather sidetracked into reading the whole damn login logic to see if there's a sensible way to avoid the 'have to do HTTP auth on all of ownCloud' problem.