code: @Override
  	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
  			throws IOException, ServletException {
  		String requestURI = request.getRequestURI();
  		UserAuthentication userAuth = null;
  		User user = null;
  
  		if (requestURI.endsWith(PASSWORD_ACTION)) {
  			user = new User();
  			user.setIdentifier(request.getParameter(EMAIL));
  			user.setPassword(request.getParameter(PASSWORD));
  			String appid = request.getParameter(Config._APPID);
  			if (!App.isRoot(appid)) {
  				App app = Para.getDAO().read(App.id(appid));
  				if (app != null) {
  					user.setAppid(app.getAppIdentifier());
  				}
  			}
  			if (User.passwordMatches(user) && StringUtils.contains(user.getIdentifier(), "@")) {
  				//success!
  				user = User.readUserForIdentifier(user);
  				userAuth = new UserAuthentication(new AuthenticatedUserDetails(user));
  			}
  		}
  		return SecurityUtils.checkIfActive(userAuth, user, true);
  	}
docs: Handles an authentication request.
  @param request HTTP request
  @param response HTTP response
  @return an authentication object that contains the principal object if successful.
  @throws IOException ex
  @throws ServletException ex