What I am feeling here is that JASPI is more than just an authentication mechanism, the mandatory checking may be needed but that placing it in the mechanism itself may not be correct.