As http methods are URI based, config.authenticate is currently URI based.
However the configuration is typically family/lang based.
Once the URI->Site mapping has been rewritten (several patches under review), http can reliably get the family/lang for a URI, then get authenticate tokens using the family/lang.