code: private boolean isValidAuthMethodForFormLogin(String authenticationMethod) {
          return LoginConfiguration.FORM.equals(authenticationMethod) ||
                 (LoginConfiguration.CLIENT_CERT.equals(authenticationMethod) && webAppSecConfig.getAllowFailOverToFormLogin());
      }
docs: Determines if the authentication method is valid for a FORM login flow.
  The valid contitions are:
  1. The authentication method is FORM
  2. The authentication method is CLIENT_CERT and allowFailOverToFormLogin=true
  
  @param authenticationMethod
  @return {@code true} if the authentication method is valid for FORM login