Authentication mechanism per URL pattern

The use case would be writing a JAX-RS endpoint that provides an API, some HTML/JS that provides an UI on top that API, and then bundling them together as a single application. I would then like to offer BASIC authentication for "machines" interacting directly with the API and FORM-based authentication for "humans" interacting indirectly via the UI.

This type of functionality was mentioned in javaee/security-spec#37 but I couldn't find a dedicated issue:

> Note that this feature is distinct from having different authentication mechanisms for different resources, like e.g. FORM for the web based UI part at /app/* of an application and BASIC for the REST part at say /rest/*.