As discussed on the mailing list:
Looks like the system allows for configuring more than just authentication filters, and those extras are configured but not displayed in the configuration GUI. There's already a constraint on the type parameter for AuthenticationFilterPanel, but it requires SecurityFilterConfig. I think it would be helpful to future plugin developers if this constraint required SecurityAuthFilterConfig (which is just a marker interface) instead. In fact the web UI breaks if this marker interface is not present, but only on the filter list.