assert authenticator factory is set in Session#authenticate