Similar to how the --authentication-key-request-url option allows fine-grained authorization with auth_key, user, and remote_addr: What about an option that receives a password instead of a public key? Right now, the only option is to have a set password for all connections, or to resort to public key authentication.

For example, if I want to authenticate users through JWT, I could have them set that token as their password, then internally validate the credential with a server that would return 200 to approve the connection. The main differences would be the connection mechanism and the fields that are sent to the server (password instead of auth_key).