The constructer for SecurityConfigImpl calls configureAuthenticator() which calls authenticator.init() and passes in a reference to itself. Unfortunately this happens before SecurityConfigImpl is fully initialised. This means, for example, if the init() method in a custom authenticator calls config.getLogoutURL() it will be returned null as the loginUrlStrategy in SecurityConfigImpl has not be initialsed yet.

We should probably fix this so that authenticator.init() is called at the very end of the constructor.