SEC-2498: RequestCache allows POST when CSRF is disabled
SEC-2533: Global AuthenticationManagerBuilder disables clearing child credentials