This change suggests that we need some additional re-factoring of the sequence of handlers used for domain management - having an authentication mechanism claim we are successfully authenticated when no authentication has occurred is bad.