AuthenticationFilter#attemptAuthentication should be protected

[jzheaux]

AuthenticationFilter#attemptAuthentication is public:

public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)

But, it should be protected until it is clear that making it public is necessary.