Don't call listeners twice
Allow override of authentication mechanism at the deployment level
Make additional authentication mechanisms use the builder API