`attemptAuthentication` and `successfulAuthentication` need to remain private while some complexities with `SecurityContextRepository` are sorted out.