code: private boolean isAuthMechOverridden() {
          WebAppSecurityConfig webAppSecConfig = getWebAppSecurityConfig();
          String value = webAppSecConfig.getOverrideHttpAuthMethod();
          if (value != null) {
              if ((value.equals(LoginConfiguration.FORM) || value.equals(LoginConfiguration.BASIC))) {
                  return true;
              } else if (value.equals(LoginConfiguration.CLIENT_CERT)) {
                  // if CLIENT_CERT is set, check failover setting.
                  if (webAppSecConfig.getAllowFailOverToFormLogin() || webAppSecConfig.getAllowFailOverToBasicAuth()) {
                      return true;
                  }
              }
          }
          return false;
      }
docs: This method validates whether the authentication mechanism needs to be overridden by the global
  login setting in webAppSecurityConfig element.
  There are two condtions when the global login setting needs to be used:
  1. when overrideHttpAuthMethod attribute is set to FORM or BASIC.
  2. when overrideHttpAuthMethod attribute is set to CLIENT_CERT, and allowAuthenticationFailOverToAuthMethod
  attribute is set to BASIC or FORM.