At the moment, z3950_responder.pl only provides anonymous access via Z39.50. That means if you want to restrict your Z39.50 endpoint using a username and password, you're forced to use Zebra. If z3950_responder.pl had support for authentication, then it would be one more nail in the coffin for Zebra, as you wouldn't need Zebra for that use case anymore.