Allow non-secure contexts (configurable)

Sometimes it is necessary to allow authentication (even basic auth) over
an open insecure line: 
- Test environments (in the IDE)
- Behind reverse Proxies where SSL handling is done by the proxy

This change allows to use the authenticator filter even if the servlet
request says it's not secure.

BTW: A missing return statement is added.