An authentication object holding both the raw user name and the mechanism
To support multiple authentication mechanism at a site, an authentication object holds both the
name of the mechanism and the user name authenticated by that mechanism. The mechanism may be
null if there is only one plugin deployed of if the deployer is sure that user names found by
different mechanisms will never be the same.