docs: private UsernamePasswordToken usernamePassword(ServiceRequestContext ctx, AggregatedHttpMessage req) {
          // check the Basic HTTP authentication first (https://tools.ietf.org/html/rfc7617)
          final BasicToken basicToken = AuthTokenExtractors.BASIC.apply(req.headers());
          if (basicToken != null) {
              return new UsernamePasswordToken(basicToken.username(), basicToken.password());
          }
  
          final MediaType mediaType = req.headers().contentType();
          if (mediaType != MediaType.FORM_DATA) {
              return throwResponse(ctx, HttpStatus.BAD_REQUEST,
                                   "The content type of a login request must be '%s'.", MediaType.FORM_DATA);
          }
  
          final Map<String, List<String>> parameters = new QueryStringDecoder(req.contentUtf8(),
                                                                              false).parameters();
          // assume that the grant_type is "password"
          final List<String> usernames = parameters.get("username");
          final List<String> passwords = parameters.get("password");
          if (usernames != null && passwords != null) {
              final String username = usernames.get(0);
              final String password = passwords.get(0);
              return new UsernamePasswordToken(loginNameNormalizer.apply(username), password);
          }
  
          return throwResponse(ctx, HttpStatus.BAD_REQUEST,
                               "A login request must contain username and password.");
      }