port HTTP Header Authenticator to Tomcat