docs: protected Response login(Object principal, String password) throws Exception {
          Config config = configBean.getConfig();
  
          AuthenticationDAO.User user = config.getAuthenticationDAO().getUserByPrincipal(session, config.getStoredProcedureProxyFactory(), principal);
          if (user != null) {
              String expectedHash = user.getPasswordHash();
              String actualHash = calculateHash(config, password, user.getPasswordSalt());
              if (expectedHash.equals(actualHash)) {
                  String securityToken = generateRandomCode(config.getSecurityTokenLength());
                  config.getSecurityTokenStorage().add(securityToken, principal);
                  NewCookie newCookie = new NewCookie(
                          config.getSecurityCookieName(), securityToken,
                          config.getSecurityCookiePath(),
                          config.getSecurityCookieDomain(),
                          config.getSecurityCookieVersion(),
                          config.getSecurityCookieComment(),
                          config.getSecurityCookieMaxAge(),
                          config.isSecurityCookieSecure());
  
                  return buildResponse(Response.ok().cookie(newCookie));
              } else {
                  return handleWrongPassword(principal);
              }
          } else {
              return handleUserNotFound(principal);
          }
      }