private function authenticate(Request $request, Response $response)
    {
        $authenticationProvider = $this->injector->getInstance(AuthenticationProvider::class);
        try {
            $user = $authenticationProvider->authenticate($request);
            if (null == $user && $this->authConstraint->loginAllowed()) {
                $response->redirect($authenticationProvider->loginUri($request));
            } elseif (null == $user) {
                // TODO should become 401 Unauthorized
                // see https://github.com/stubbles/stubbles-webapp-core/issues/73
                $this->error = $response->forbidden();
                return null;
            }

            return $user;
        } catch (AuthProviderException $ahe) {
            $this->handleAuthProviderException($ahe, $response);
            return null;
        }
    }