function _auth( config, options, forceAuthentication ) {
	// If we're not supposed to authenticate, don't even start
	if ( ! forceAuthentication && ! options.auth && ! options.nonce ) {
		return config;
	}

	// Enable nonce in options for Cookie authentication http://wp-api.org/guides/authentication.html
	if ( options.nonce ) {
		config.credentials = 'same-origin';
		return _setHeader( config, 'X-WP-Nonce', options.nonce );
	}

	// If no username or no password, can't authenticate
	if ( ! options.username || ! options.password ) {
		return config;
	}

	// Can authenticate: set basic auth parameters on the config
	let authorization = `${ options.username }:${ options.password }`;
	if ( global.Buffer ) {
		authorization = global.Buffer.from( authorization ).toString( 'base64' );
	} else if ( global.btoa ) {
		authorization = global.btoa( authorization );
	}

	return _setHeader( config, 'Authorization', `Basic ${ authorization }` );
}
Conditionally set basic or nonce authentication on a server request object.

@method _auth
@private
@param {Object} config A fetch request configuration object
@param {Object} options A WPRequest _options object
@param {Boolean} forceAuthentication whether to force authentication on the request
@param {Object} A fetch request object, conditionally configured to use basic auth