SEC-2297: Add DispatchType.ASYNC as default for AbstractSecurityWebApplicationInitializer
SEC-2296: HttpServletRequest.login should throw ServletException if already authenticated

See throws documentation at
http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login%28java.lang.String,%20java.lang.String%29