If the user doesn't specify a username in the HR client config, the message is not very helpful:

Cannot enable authentication without specifying a Callback Handler or a client Subject

Replace it with

Cannot enable authentication without specifying either a username, a token, a client Subject or a CallbackHandler