No need to say that you have achieved a great refactoring on this, my remarks are just trying to respectfully improve even more our design.

You are now returning a ```Pair<Principal, List<Message>>``` instead of a ```Principal``` for the ```authenticateUsernamePasswordInternal``` method: it makes sense to me; I'm not completely convinced by the ```Pair``` structure but I don't see anything better right now.

My only concern is the ```passwordPolicyConfiguration``` object in the authentication handlers: I'm not sure it's totally appropriate, the password policy configuration is only meaningfull for the account state handlers and not for the authentication handlers as it deals with password policy. By the way, I've made a search across the pull request and I don't see any use of the ```passwordPolicyConfiguration``` object in the authentication handlers. It might be removed maybe...