change credentials order in authentication manager example

username/password pairs were incorrect. The authentication manager has "user" and "password", so those credentials should be allowed to get the actual message.
Tweak security example