Allowing plain UsernamePasswordTokens so can be used from standard Shiro
filters like BasicAuth