`authenticationHandler` does this check, and if it doesn't, then it should.