Right:

<http-authentication-factory name="management-http-authentication" security-domain="ManagementDomain" http-server-mechanism-factory="global">

Wrong:

<http-authentication-factory name="management-http-authentication" http-server-mechanism-factory="global" security-domain="ManagementDomain">

The xsd and the persistence logic does it right; the template does it wrong so our standard config is wrong.

Galleon will do it right so fixing this is basically about eliminating spurious differences between the WFCORE-3769 galleon output and the legacy output.