Provide authenticators that can do negotiate headers back to the browser and fall back on the web app configured auth method (BASIC/FORM).