should all of this pattern config live in the Authentication filter?