Spring Security Core Basic and Form Authentication

[Jeff Scadden]

Since I want to use my controllers as my API into the application (for
HTML, XML, JSON, etc.. requests). Is there a way to configure Spring
Security to allow Basic and Form authentication. I would like it to
check for Basic first and then fall back to Form authentication.

It seemed like this is the default for acts_as_authentication, and the
device plugin for Rails.

What patterns do you follow to support an HTML client and webservice
client (XML or JSON responses).

Thanks,
- Jeff