Hmm, not for this CL, but a possible TODO: username/password pair gets passed around a lot, especially in this new code - wrap in something like `LoginInfo`?