Comment 7 for bug 1468422

Sounds good. To recap:

Create new API calls .init.barcode and .init.username. Both are strict about treating a barcode as a barcode / username as a username. Barcode/username info is stored in the cache along with the auth seed, nonce, etc. (Should also toss the user ID in to avoid another search in .complete).

Modify the existing .init API to perform barcode vs. username detection, using the same algorithm in place w/ the TPAC. (Check org settings, etc. Later, we could remove this logic from the TPAC to avoid multiple variants of the same logic). Once determined, call the appropriate .init.barcode or .init.username handler.

Modify the .complete API to read the new barcode/username data from the cache, and honor that data over anything provided by the caller.