unchange the behavior of UsernamePasswordExtractingAuthenticationManager as there is a weird condition where the authentication object is the principal
look in UAA first