code: protected IPromise<BasicAuthenticationResult> getCredentials(String user, String pw, String jwt) {
          Promise p = new Promise();
          if ( SESSIONID_SPECIAL_STRING.equals(pw) ) {
              sessionStorage.getUserFromSessionId(user).then( (r,e) -> {
                  if ( r != null ) {
                      sessionStorage.getUser(r).then( (rec,err) -> {
                          if ( rec != null )
                              getCredentials(rec.getKey(),rec.getString("pwd"), null ).then(p);
                          else
                              p.reject("unknown user");
                      });
                  } else {
                      p.reject("authentication failed");
                  }
              });
          } else {
              sessionStorage.getUser(user).then((rec, err) -> {
                  if (rec == null) {
                      p.reject("wrong user or password");
                  } else {
                      if (pw.equals(rec.getString("pwd"))) {
                          if (!rec.getBool("verified")) {
                              // e.g. email verification etc.
                              p.reject("account not verified");
                          } else
                              p.resolve(new BasicAuthenticationResult().userName(rec.getKey()));
                      }
                  }
              });
          }
          return p;
      }
docs: does a lookup for a user record using 'user' as key. Compares pw with 'pwd' of user record if found
  if user denotes a vaild old session id and pwd == 'SESSION_ID', a session is created from a previous authentication
  
  @param pw
  @param jwt
  @return