xitrum.handler.inbound
f takes username and password, and returns true if it want to let the user in.