The isMandatroy check in line 77 is really NOT needed, as soon as I can persuade git to cooperate, I will update the PR.

The spec says that the SAM  may return SUCCESS for the check, but set an Unauthenticatated principal. 
I figured that  NOT_ATTEMPTED is the right way to map this to undertow, but obviously I am not the undertow security expert here, so there may be a better way, like
- Returning AUTHENTICATED, without calling  authenticationComplete -- I am not sure this would legal.
- Returning AUTHENTICATED, and calling authenticationComplete with a null account -- again, I'm not sure it wouldn't break stuff.