Ensure authentication events get published

When the user provides their own AuthenticationManager we do a lazy
initialization and didn't (till now) inject the AuthenticationEventPublisher

Fixes gh-2033