fix for "PolicyBasedAuthenticationManager doesn't care about existing

attributes" Issue 784
I think merging should be the default behaviour ```= true```.