docs: function trustableAuthHandler(//{{{
      authHandler,
      pathSpec,
      ext,
      method,
      ac,
      req,
      actualRes,
      actualNext
  ) {
  
      // Provide fake http environment:
      var httpDone = false;
      var res = Object.create(actualRes);
      res.send = function newSend(){
          actualRes.send.apply(actualRes, arguments);
          httpDone = true;
      };
      function next(){
          actualNext.apply(this, arguments);
          httpDone = true;
      };
  
      // Call actual authentication handler:
      var auth = authHandler(
          pathSpec,
          ext,
          method,
          ac,
          req,
          res,
          next
      );
  
      // Ensure http handshake is fully handled:
      if (! httpDone && typeof auth != "object") {
          var msg = (typeof auth == "string")
              ? auth
              : "Access denied."
          ;
          Util.sendStatusMessage(actualRes, "forbidden", msg);
          httpDone = true;
      };
      if (httpDone) auth = false; // Any response handling in authHandler is also an access reject.
  
  
      // Ensure consistent auth interface.
      if (auth) {
          auth.filter || (auth.filter = defaultResponse.filter);
          auth.userData || (auth.userData = defaultResponse.userData);
          auth.privileges || (auth.privileges = defaultResponse.privileges);
          if (
              (typeof auth.filter != "function")
              || (typeof auth.userData != "object")
              || (typeof auth.privileges != "function")
          ) {
              console.error("Wrong auth object", auth);
              Util.sendStatusMessage(actualRes, "error", "Internal Server Error");
                  // With httpDone = true we were never got here ;-)
          };
      };
  
      // Return trusted auth data.
      return auth;
  
  }