I think you're missing the point of the enum and strategy combo. This is OUR implementation. Users are FREE to create their own implementation by SessionAuthenticationStrategy.