Better separations of concerns: AuthenticationStrategy is intended to select preferred auth schemes without performing actual authentication; auth handling code moved to HttpAuthenticator