> My only concern is the `passwordPolicyConfiguration` object in the authentication handlers:
> I'm not sure it's totally appropriate, the password policy configuration is only meaningfull for
> the account state handlers and not for the authentication handlers as it deals with password policy.

I put it in a base class, `AbstractUsernamePasswordAuthenticationHandler`, that deals with password credentials for the purpose of ease of extension. I admit it's unused and may be a case of premature design, but it does seems like it would be required on the `AuthenticationHandler` in some fashion to be implemented in other handlers like the database ones.