dsRESTConnection component won't allow me change the .username and .password after the first connect - rest

Question

In my Delphi 10.3.1 application server (which is a "DataSnap REST Application"), I have put some logging as follows:
procedure TWebModule1.DSAuthenticationManager1UserAuthenticate(
Sender: TObject; const Protocol, Context, User, Password: string;
var valid: Boolean; UserRoles: TStrings);
begin
valid := (User > '') and (Password > ''); // pass-through
if Valid then
begin
MyWebUtils.LogMessage('Authentication, ' + User + ', ' + Password +
', ' + protocol + ', ' + context);
TDSSessionManager.GetThreadSession.PutData('USERNAME', User);
end;
end;
In my client (on Android), which uses a dsRestConnection, I have a procedure to test the connection, which I call, for example in FormShow of the main form.
function TClientModuleRest.TestConnect(var ErrorMsg: String): Boolean;
var
returned: String;
begin
Result := True;
try
DSRestConnection.Username := 'Admin';
DSRestConnection.Password := 'Test';
DSRestConnection.TestConnection([toNoLoginPrompt]);
except
on e: exception do
begin
Result := False;
ErrorMsg := e.Message;
end
end;
end;
This works well.
The problem occurs when I call the first Server method.
function TClientModuleRest.ValidUser(username, password: String;
var Response: String): Integer;
var
Server: TServerMethodsRClient;
Valid: Boolean;
IniFile: TStringList;
FileName: TFileName;
begin
Result := 0;
DSRestConnection.UserName := username;
DSRestConnection.Password := password;
try
Server := TServerMethodsRClient.Create(DSRestConnection);
try
Valid := Server.ValidUser(username, password, Response);
if not Valid then
raise Exception.Create(response);
Result := 1;
finally
Server.Free;
end;
except
on e: exception do
begin
Response := e.Message;
Result := -1; // an error occured
end;
end;
end;
So the problem is that the setting of the .username and .password doesn't 'take'. In other words, my conclusion is that the .username and `.password can only be set before the first connect, and not thereafter.
The server log file shows that even though the ValidUser function was called with the username and password values that were passed to it, the authentication is receiving the username and password from the first (test) connect.
Is this by design? Or am I missing something? Thanks.