Using Supplier<@Nullable Authentication> prevents Supplier<Authentication> from being passed in. Instead we should use Supplier<? extends @Nullable Authentication> which allows both a null and non-null Authentication