user, having verified password with the node's authenticator. The principal's user id is the one the authenticator resolves — for OIDC, the token's subject.
(xtdb.authn/failed) if the credentials are rejected.
if the node's authenticator doesn't support password authentication.