I am am not making sense out of what routing and dispatch are doing. For example logging sets off a activity going back and forth from the FrontController to Session and back. I need to through authentication from an external app, so when people login to it, we only need to send the email address, username, or user_id to get logged into XF. We have it running we it does not make any difference what the password is, the response from authentication is to be the one a good password gets. However, no password doesn't work because no authentication request reaches the authenticator .