No opinions here, but aside from creating two authentication objects, I take it that the idea is that we are not using a different authentication type, the thing that changes is the principal and the way attributes are handled. `authToUse` is always an instance of `MutableAuthentication`, so I dont see an immediate benefit of clearing that out unless we had different authN types/classes.