diff --git a/README.md b/README.md
index 8e283ed4..5c09ac7c 100644
--- a/README.md
+++ b/README.md
@@ -67,6 +67,7 @@ turn almost any device into a file server with resumable uploads/downloads using
     * [event hooks](#event-hooks) - trigger a program on uploads, renames etc ([examples](./bin/hooks/))
         * [upload events](#upload-events) - the older, more powerful approach ([examples](./bin/mtag/))
     * [handlers](#handlers) - redefine behavior with plugins ([examples](./bin/handlers/))
+    * [identity providers](#identity-providers) - replace copyparty passwords with oauth and such
     * [hiding from google](#hiding-from-google) - tell search engines you dont wanna be indexed
     * [themes](#themes)
     * [complete examples](#complete-examples)
@@ -1193,6 +1194,17 @@ redefine behavior with plugins ([examples](./bin/handlers/))
 replace 404 and 403 errors with something completely different (that's it for now)
 
 
+## identity providers
+
+replace copyparty passwords with oauth and such
+
+work is [ongoing](https://github.com/9001/copyparty/issues/62) to support authenticating / authorizing users based on a separate authentication proxy, which makes it possible to support oauth, single-sign-on, etc.
+
+it is currently possible to specify `--hdr-au-usr x-username`; copyparty will then skip password validation and blindly trust the username specified in the `X-Username` request header
+
+the remaining stuff (accepting user groups through another header, creating volumes on the fly) are still to-do
+
+
 ## hiding from google
 
 tell search engines you dont wanna be indexed,  either using the good old [robots.txt](https://www.robotstxt.org/robotstxt.html) or through copyparty settings:
@@ -1369,6 +1381,10 @@ dnf install python3-copyparty  # just a minimal install, or...
 dnf install python3-{copyparty,pillow,argon2-cffi,pyftpdlib,pyOpenSSL} ffmpeg  # with recommended deps
 ```
 
+`ffmpeg` comes from [rpmfusion](https://rpmfusion.org/Configuration#Command_Line_Setup_using_rpm) so it's recommended to enable that (you don't want `ffmpeg-free` since it fails to thumbnail most h264/mkv/mp4 videos)
+
+to run copyparty as a service, use the [systemd service scripts](https://github.com/9001/copyparty/tree/hovudstraum/contrib/systemd), just replace `/usr/bin/python3 /usr/local/bin/copyparty-sfx.py` with `/usr/bin/copyparty`
+
 this *may* also work on RHEL but [I'm not paying IBM to verify that](https://www.jeffgeerling.com/blog/2023/dear-red-hat-are-you-dumb)
 
 
diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index a71fe1fa..45d1fac5 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -447,8 +447,8 @@ class HttpCli(object):
             self.pw = ""
             self.uname = self.headers.get(self.args.hdr_au_usr) or "*"
             if self.uname not in self.asrv.vfs.aread:
-                self.loud_reply("unknown username: [%s]" % (self.uname), 401)
-                return False
+                self.log("unknown username: [%s]" % (self.uname), 1)
+                self.uname = "*"
         else:
             self.pw = uparam.get("pw") or self.headers.get("pw") or bauth or cookie_pw
             self.uname = self.asrv.iacct.get(self.asrv.ah.hash(self.pw)) or "*"