using servlet3 auth as source