Use user-string in authentication attributes.

Based on changes under review in PR #2116
Unauthorized