I thought about it last night. I think it's possible to return a d/chain from the authentication interceptor in which the creds are pulled.

It's definitely needed because otherwise it introduces a sync barrier if you use a database to validate.