Allow non-secure contexts (configurable)

Sometimes it is necessary to allow authentication (even basic auth) over
an open insecure line: 
- Test environments (in the IDE)
- Behind reverse Proxies where SSL handling is done by the proxy

This change allows to use the authenticator filter even if the servlet
request says it's not secure.

BTW: A missing return statement is added.

osgi.enroute.websecurity.adapter/src/osgi/enroute/websecurity/adapter/SecurityFilter.java

@@ -46,6 +46,7 @@ public class SecurityFilter implements Filter {
 	private AtomicReference<AuthorityAdmin>		authorityAdminRef	= new AtomicReference<AuthorityAdmin>();
 	private volatile boolean					reported;
 	private String								realm;
+	private boolean 							allowAuthOverNonSecureLine 	= false;
 
 	interface Config {
 		@Meta.AD(deflt = DEFAULT_REALM)
@@ -56,6 +57,11 @@ interface Config {
 		String filter();
 
 		String alias();
+
+		@Meta.AD(deflt = "false", description="Authentication over non-secure lines is dangerous. "
+											+ "But sometimes it is necessary, eg behind a reverse "
+											+ "proxy which handles HTTPS. ")
+		boolean allowAuthOverNonSecureLine();
 	}
 
 	/*
@@ -89,8 +95,10 @@ public Void call() throws Exception {
 		// and an open line is basically all,well, eh, open
 		//
 
-		if (!req.isSecure())
+		if (!allowAuthOverNonSecureLine && !req.isSecure()) {
 			run(null, runAs);
+			return;
+		}
 
 		if (req instanceof HttpServletRequest) {