At the point this is fired, we actually have a `UserDetails`, not an `Authentication`, so contructing an `Authentication` just to wrap the username and groups seems like overkill. Anyway the idea was to insulate listener implementations at least a bit from the API details and offer easily understandable parameters.

(I really wanted to fire _either_ `loggedIn` _or_ `authenticatedToREST`, but did not find a way to do this.)