SonarCloud reports:
  Ensure this "Optional" could never be null and remove this null-check.

Here:
 
    public static final BiPredicate<String, String> CONTEXT_RESTRICTED(HttpClient client) {
        return (k, v) -> client.authenticator() == null || // <---- here
                ! (k.equalsIgnoreCase("Authorization")
                        && k.equalsIgnoreCase("Proxy-Authorization"));
    }

client.authenticator() returns Optional<Authenticator>, so maybe client.authenticator().isPresent() was intended?