Explain AuthenticationFilter's handling of return values / exceptions