code: public Principal authenticate(String username,
                                    Object credentials,
                                    HttpRequest request)
      {
  
      	synchronized(this)
      	{
      		long now = System.currentTimeMillis();
      		if (now - _lastHashPurge > _cacheTime || _cacheTime == 0)
      		{
      			super.clear();
      			_roles.clear();
      			_lastHashPurge = now;
      		}
      		Principal user = (Principal)super.get(username);
      		if (user == null)
      		{
      			loadUser(username);
      			user = (Principal)super.get(username);
      		}
      	}
          return super.authenticate(username, credentials, request);
      }
docs: /* ------------------------------------------------------------