AuthenticationFilter should not call identity.login() unless the request is a login attempt

Attempting Identity.login() in for every denied request causes the filter to throw exceptions when the browser is making requests in parallel (for example, fetching images, css, or javascript from a protected URI).