BasicAuthenticationFilter onUnsuccessfulAuthentication call twice

Question

in beans:

<http auto-config="false" disable-url-rewriting="false">
        <intercept-url pattern="/server/**" access="permitAll"/>
        <intercept-url pattern="/includes/**" access="permitAll"/>
        <intercept-url pattern="/favicon.ico" access="permitAll"/>
        <intercept-url pattern="/" access="permitAll"/>
        <intercept-url pattern="/index.html" access="permitAll"/>
        <intercept-url pattern="/help/**/*" access="permitAll"/>
        <intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
        <custom-filter ref="unsuccessfulBasicAuthenticationFilter" position="BASIC_AUTH_FILTER"/>
    </http>

Call twice:

public class UnsuccessfulBasicAuthenticationFilter extends BasicAuthenticationFilter {

 @Override
    protected void onUnsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException {
        if (failed instanceof BadCredentialsException) {
            failedLogonAttemptsHandler.onFailedLogonAttempt();
        }
        super.onUnsuccessfulAuthentication(request, response, failed);
    }
}

But method onUnsuccessfulAuthentication call twice.