cas-670: Client authentication from pac4j should always return typed identifier