Use ApplicationEvent to ensure that authentication event publisher is registered

There was a reference to an old (fixed) issue in Spring which led to some simplification
of the AuthenticationManager layering as well.

Fixes gh-1335