APIs should Use `Supplier<? extends @Nullable Authentication>`

[rwinch]

Using Supplier<@Nullable Authentication> prevents Supplier<Authentication> from being passed in. Instead we should use Supplier<? extends @Nullable Authentication> which allows both a null and non-null Authentication