This is due to a call to HeadersTrustedAuthenticationAdapter#getHeader() which will return nulll if the header is undefined