With GeoServer 2.5, the status code expected changes to a 403 for the attemptAuthentication request so added a handle