usernamepasswordauthenticationtoken vs preauthenticatedauthenticationtoken