What about splitting the interface into two?

1 - A interface that only defines `authenticate()` (implementations can be stateless).
2 - Another interface that extends the first one + defines the Identity management API.