a little piece of dodginess to allow configuration of preferred
authentication method at the client level.  Since I can't upgrade to
2.7, I will get around it by defining two clients for the same endpoint.