This is a generic HTTP authentication framework not a Servlet authentication framework so should double check the naming is consistent with regards to the HTTP specifications not Servlet.