UPDATE: local username/password authentication