BasicAuthenticationRESTController: bad credentials check improved