In the X.509 authentication case (unlike CAS, for example) the certificate
will already have been extracted from the request and a secure context
established by the time the security-enforcement filter is invoked.
Therefore this class isn't actually responsible for the commencement of
authentication, as it is in the case of other providers.