LPS-37772 TunnelingServletAuthVerifier must be used before BasicAuthHeaderAutoLogin
LPS-37772 Log remote exceptions correctly
LPS-37772 Standard Basic auth should be forbidden for TunnelServlet
LPS-37772 I'd rather not rely on the order to achieve the correct behavior
LPS-37772 See attributes.excludes in portal.properties, match that