Do we need this? If there's no username then the request won't authorize and you'll get a 403?