Interesting that AuthenticationManager responsible for policy as to whether satisfied.  How does this relate to policy depending on service to which user is seeking to authenticate?  Matching service routes to a relevant AuthenticationManager?  AuthenticationManager relies on a service registry?