...
- Even if the supports method exists the AuthenticationHandler will need to handle the "request not supported" condition in the case that the caller didn't bother to call supports().
- Using two calls allows for intervening changes to lead to inconsistency. It is far fetched but not impossible to imagine a dynamic provider which can support a type when supports is called but can't handle it by the time the authenticate method is called.
...