Actually this is an expected behavior:
The handlers are invoked in a bottom-up fashion in the incoming path and top-down in the outgoing path. That is, the last entry is called first for an incoming request messasge but invoked last for an outgoing response message.
If it makes easy, in your example, you can think of them like one handler is stacked over the other:
Request: -> AuthorisationMessageHandler -> AuthenticationMessageHandler ->
Response: <- AuthorisationMessageHandler <- AuthenticationMessageHandler <-