Thanks @CIPop for the analysis, let's get the NRE fix in. If you think you found another clear bug in AuthenticationFailure which is likely going to bite us, please submit fix as well. A separate one.

We have a bunch of fixes coming in to the managed HttpListener. We should roll-up and review all changes made since forking for 2.0, and port them over en masse rather than reviewing each piece meal.