changes to use j2ee auth methods on the request