iirc it was mostly a decision made around performance - the idea was to keep authentication overhead as small as possible