docs: private String getFailOverToAuthType(WebRequest webRequest) {
          String authType = null;
          if (webAppSecurityConfig.getAllowFailOverToAppDefined()) {
              SecurityMetadata securityMetadata = webRequest.getSecurityMetadata();
              LoginConfiguration loginConfig = securityMetadata.getLoginConfiguration();
              if (loginConfig != null) {
                  authType = loginConfig.getAuthenticationMethod();
              }
          } else if (webAppSecurityConfig.getAllowFailOverToBasicAuth() && webAppSecurityConfig.getAllowFailOverToFormLogin()) {
              if (appHasWebXMLFormLogin(webRequest) || globalWebAppSecurityConfigHasFormLogin()) {
                  authType = LoginConfiguration.FORM;
              } else {
                  authType = LoginConfiguration.BASIC;
              }
          } else if (webAppSecurityConfig.getAllowFailOverToFormLogin()) {
              authType = LoginConfiguration.FORM;
          } else if (webAppSecurityConfig.getAllowFailOverToBasicAuth()) {
              authType = LoginConfiguration.BASIC;
          }
          return authType;
      }