Move DefaultAuthenticationService to request scope
Replace RequestContextListener with RequestContextFilter as only the latter is able to provide the HttpServletResponse for injection