Actually, it can be handled by a proxy rather than a relay. It still handles all the other authentication tasks, so why not this one?