how about a method that computes the fulfilledAuthenticationMethods String and returns it, and make shoving it into the model the responsibility of the calling method?

this method implementation looks like it wants to be refactored.