use basic-auth username as principal if some is given
for tests do preemptive authentication to avoid an additional request
test whitelist-authentication via spring bean manipulation