why does AuthenticationHandler#extractCredentials require the HttpServletResponse parameter?

[Clemens Wyss]

in which use case is the (HTTPServlet)response of relevance for extracting the 
credentials?

Thx
Clemens