code: protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response) {
          LOGGER.debug("Authentication failed");
          SecurityContextHolder.clearContext();
          getRememberMeServices().loginFail(request, response);
      }
docs: Called by {@link #login(Authentication, boolean)} upon unsuccessful authentication. This implementation will
  clear the security context holder and inform the {@code RememberMeServices} of the failed login.
  
  @param request the current request.
  @param response the current response.