title: Spring Security - conditionally use form-login if external auth fails / doesn't exist
body: <p>My required setup is a (spring-security enabled) webapp that can either be pre-authenticated (using pubcookie) OR have a "dev" mode enabled so I can ignore pubcookie and show a login form. Naturally, dev-mode will be turned-off in production, where the app will sit behind an Apache running mod_pubcookie, but for dev/QA I don't really need the external authentication mechanism.</p>
  
  <p>The login form should appear only if (1) there's no REMOTE_USER request header (meaning we didn't go through pubcookie); AND (2) dev-mode is turned on in a property file.</p>
  
  <p>My question: can this be configured in the spring security XML file, or do I need to take this into the code? (and how do I do that?)</p>
  
  <p>Thanks,</p>
  
  <p>D.</p>