Special handling for form-based logins to deal with the case where
a resource is protected for some HTTP methods but not protected for
GET which is used after authentication when redirecting to the
protected resource.
TODO: This is similar to the FormAuthenticator.matchRequest() logic
Is there a way to remove the duplication?