The fact that the web security and the authentication manager are
controlled separately should hopefully now be clearer.

Fixes gh-3292