Need a similar set of classes as we have for SASL: -

• Security Domain / HTTP Mechanisms Factory configuration.
• Provider based loading
• Service loader based loading

Will reserve advanced filtering till later but some simple filtering can be added.