No need to keep it around after Authenticate succeeds while handling the HTTP request (via next.ServeHTTP).