As noted in the invirt.authz.locker._authenticate docstring, if we