code: private String getFailOverToAuthType(WebRequest webRequest) {
          String authType = null;
          if (webAppSecurityConfig.getAllowFailOverToAppDefined()) {
              SecurityMetadata securityMetadata = webRequest.getSecurityMetadata();
              LoginConfiguration loginConfig = securityMetadata.getLoginConfiguration();
              if (loginConfig != null) {
                  authType = loginConfig.getAuthenticationMethod();
              }
          } else if (webAppSecurityConfig.getAllowFailOverToBasicAuth() && webAppSecurityConfig.getAllowFailOverToFormLogin()) {
              if (appHasWebXMLFormLogin(webRequest) || globalWebAppSecurityConfigHasFormLogin()) {
                  authType = LoginConfiguration.FORM;
              } else {
                  authType = LoginConfiguration.BASIC;
              }
          } else if (webAppSecurityConfig.getAllowFailOverToFormLogin()) {
              authType = LoginConfiguration.FORM;
          } else if (webAppSecurityConfig.getAllowFailOverToBasicAuth()) {
              authType = LoginConfiguration.BASIC;
          }
          return authType;
      }
docs: Determine the failover type based on available configuration.
  <p>
  If both FORM and BASIC are valid for failover, then pick one as follows:
  If there is a form login configuration present, then FORM login is the
  intended failover. If form login configuration is not present, then
  BASIC is the only logical remaining option.
  <p>
  If only FORM or BASIC is allowed, select the appropriate one.
  If neither failover is allowed, null is returned.
  
  @return {@link LoginConfiguration#BASIC}, {@link LoginConfiguration#FORM}, or {@code null}. See method description.