> `drupal_static()`

I don't think that we ever need to reset the static cache outside the current scope, so I'm not sure that `drupal_static()` is a good fit here.

> Maybe we can remove the $account from the process() function, and instead we can have $handler->setAccount().
> Then $handler->getAccount() will either return the set account, or call the authentication provider to get one.

I almost implemented this pattern, but discarded for overkill. Now that it makes two of us seems a good idea now.