Digest: How to validate nonces without user?

In the Digest constructor the 1st function passes in the username, which is where you validate the user exists and then pass back the decrypted password. In the 2nd function, you can validate nonces to avoid replay attacks, but the only parameter passed in, beside the `done` function, is the `params` object containing the nonce, cnonce, nc, and opaque values.

I'm not sure how we're supposed to determine which user we're dealing within the nonce validation function. I assume the functions are asynchronous, so theoretically if more than one user is authenticating at the same time, I can't assume that the functions will be synchronously called for the same user and save off the user in a static variable somewhere.

Am I missing something? Thanks.

Start with the Digest constructor and trace the first and second callback signatures, including the params object and its nonce, cnonce, nc, and opaque values. Determine how nonce validation can identify the authenticating user without shared mutable state; done means the supported flow is documented or implemented and handles concurrent authentication safely.

Written by the indexing model from the issue text.