`authenticate` could well be no-op, while `clearIdentity` really looks like an expenctancy...