JAAS Authentication with HTTP Headers