Windows authentication will need to be smart enough in its plugin to allow you to reject users

[jeremydmiller]

We'll need it on our current project. If the user doesn't have role XYZ, we won't allow them in.

Maybe do it by changing the signature of IWindowsPrincipalHandler