The admin rule is now associated with 2 `AuthenticationListener`.
The `UrlAuthenticationListener` is before the `HttpBasicAuthenticationListener`.