From the existing code: ```user = c->username ? c->username : user;```, if you do not provide a username in the credentials, it will try and use extracted from the URL (if any).

I expect that if one is not provided in the url, and you do not provide one, the authentication will and should fail.