The pattern is that messages here should return the more generic AuthenticationMechanismException, integrations can then convert this so the appropriate Exception type.

Presently this ElytronMessages class can not be loaded without the HttpAuthenticationException being on the class path but it should be possible to use SASL without HTTP.

We maybe could even decouple further and provide a Function to handle the conversion.