Authentication by Assertion when requested in /cms, or authentication by
credentials attributes when requested by /site.