docs: @Override
      protected void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {
          clearSession(request);
  
          JSONObject json = ServletHelpers.readObject(request.getReader());
          String username = (String) json.get("username");
          String password = (String) json.get("password");
  
          AuthenticateResult result = Authenticator.authenticate(
              authConfiguration, request, username, password,
              subject -> {
                  LOG.info("Logging in user: {}", AuthHelpers.getUsername(subject));
                  setupSession(request, subject, username);
                  sendResponse(response, subject);
              });
  
          switch (result) {
              case AUTHORIZED:
                  // response was sent using the authenticated subject, nothing more to do
                  break;
              case NOT_AUTHORIZED:
              case NO_CREDENTIALS:
                  ServletHelpers.doForbidden(response);
                  break;
          }
      }