docs: private boolean isValidAuthMethodForFormLogin(String authenticationMethod) {
          return LoginConfiguration.FORM.equals(authenticationMethod) ||
                 (LoginConfiguration.CLIENT_CERT.equals(authenticationMethod) && webAppSecConfig.getAllowFailOverToFormLogin());
      }