- add docs, tests - deprecate DummyAuthenticator.password, pointing to new class - accept no password as valid config (no login possible) - log warnings for suspicious config (e.g. passwords not set, admin password set, but no admin users, etc.)
rest-api-{operation}