The fact that the web security and the authentication manager are controlled separately should hopefully now be clearer. Fixes gh-3292
