Clarify behaviour with pre-emptive authentication

The HTTP spec allows pre-emptive authentication - i.e. sending credentials before the server asks for them. It is unclear from the Servlet spec how getRemoteUser() and friends should behave in this regard when the resource being requested does not require authentication. Should the credentials be processed or ignored?

Review the Servlet specification's authentication behavior around pre-emptive credentials and the definitions of getRemoteUser() and related methods. Resolve whether credentials are processed or ignored when the requested resource does not require authentication, then document the agreed normative behavior in the specification.

Written by the indexing model from the issue text.