Review usage of Authentication.UNAUTHENTICATED in SecurityHandler

[lachlan-roberts]

Review usage of Authentication.UNAUTHENTICATED in SecurityHandler.

The JaspiAuthenticator may return this in the case that it did not receive a Principal to use and returning UNAUTHENTICATED the request to continue through the SecurityHandler even if authentication was mandatory.

I think we may need to add a case in SecurityHandler.handle for:

else if ((authentication == Authentication.UNAUTHENTICATED) && isAuthMandatory)
{
    response.sendError(HttpServletResponse.SC_FORBIDDEN, "unauthenticated");
    baseRequest.setHandled(true);
}

[janbartel]

Looks good - PR?