They are no longer set when calling `authenticate()` but rather when `unathenticated()` is called. `AuthComponent::_getUser()` is now called for all requests which in turn calls `getUser()` of all athenticators. If none of the authenticators return a user record then `AuthComponent::_unauthenticate()` calls `unauthenticated()` which is what would trigger the headers if basic/digest is the last authenticator in the list.