It's pretty easy to forget to clean up a ServerAuthenticationContext when using it directly for simple authentication. We can make this easier by making it implement AutoCloseable with a close() method that fails the authentication if it is still open.

The logic would basically be similar to if (! isDone()) fail(); but with the difference that it should be atomic, and it should not be declared to throw any exceptions because none are possible in this scenario.