How about we make authentication optional, and have the protocol being stateful only if you want to authenticate?

That way we don't break backwards compatibility or introduce extra complexity for people who don't need it.

Mark