code: func (s *rpcServer) checkAuth(r *http.Request, require bool) (bool, bool, error) {
  	authhdr := r.Header["Authorization"]
  	if len(authhdr) <= 0 {
  		if require {
  			rpcsLog.Warnf("RPC authentication failure from %s",
  				r.RemoteAddr)
  			return false, false, errors.New("auth failure")
  		}
  
  		return false, false, nil
  	}
  
  	authsha := sha256.Sum256([]byte(authhdr[0]))
  
  	// Check for limited auth first as in environments with limited users, those
  	// are probably expected to have a higher volume of calls
  	limitcmp := subtle.ConstantTimeCompare(authsha[:], s.limitauthsha[:])
  	if limitcmp == 1 {
  		return true, false, nil
  	}
  
  	// Check for admin-level auth
  	cmp := subtle.ConstantTimeCompare(authsha[:], s.authsha[:])
  	if cmp == 1 {
  		return true, true, nil
  	}
  
  	// Request's auth doesn't match either user
  	rpcsLog.Warnf("RPC authentication failure from %s", r.RemoteAddr)
  	return false, false, errors.New("auth failure")
  }
docs: // checkAuth checks the HTTP Basic authentication supplied by a wallet
  // or RPC client in the HTTP request r.  If the supplied authentication
  // does not match the username and password expected, a non-nil error is
  // returned.
  //
  // This check is time-constant.
  //
  // The first bool return value signifies auth success (true if successful) and
  // the second bool return value specifies whether the user can change the state
  // of the server (true) or whether the user is limited (false). The second is
  // always false if the first is.