Revert "passwordfix: This removes the password clearing from the authentication service"

This reverts commit elastic/x-pack@29462b494f.

Original commit: elastic/x-pack-elasticsearch@50e42933f0

src/main/java/org/elasticsearch/shield/authc/InternalAuthenticationService.java

@@ -97,6 +97,7 @@ public class InternalAuthenticationService extends AbstractComponent implements
     @SuppressWarnings("unchecked")
     public User authenticate(String action, TransportMessage<?> message, AuthenticationToken token) throws AuthenticationException {
         assert token != null : "cannot authenticate null tokens";
+        try {
             User user = (User) message.getContext().get(USER_CTX_KEY);
             if (user != null) {
                 return user;
@@ -116,5 +117,9 @@ public class InternalAuthenticationService extends AbstractComponent implements
                 auditTrail.authenticationFailed(token, action, message);
             }
             throw new AuthenticationException("Unable to authenticate user for request");
+        } finally {
+            token.clearCredentials();
+        }
+
     }
 }