Basic auth filter accepts header characters beyond the padding

When a header for basic auth is received such as "Basic jdhglsadjgh==WhatEver", the "WhatEver" is ignored and the authentication attempt is successful. This stopped happening in the latest snapshot because we started using the Java Base64 decoder instead of commons-codec, now the case results in a 500. We need to provide a compatibility option to continue accepting such headers while changing the default to return a 401.