code: @Override
  	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
  			throws IOException {
  		final String requestURI = request.getRequestURI();
  		UserAuthentication userAuth = null;
  
  		if (requestURI.endsWith(TWITTER_ACTION)) {
  			String verifier = request.getParameter("oauth_verifier");
  			String appid = SecurityUtils.getAppidFromAuthRequest(request);
  			String denied = request.getParameter("denied");
  			String redirectURI = SecurityUtils.getRedirectUrl(request) + (appid == null ? "" : "?appid=" + appid);
  			App app = Para.getDAO().read(App.id(appid == null ? Config.getRootAppIdentifier() : appid));
  			String[] keys = SecurityUtils.getOAuthKeysForApp(app, Config.TWITTER_PREFIX);
  			if (denied != null) {
  				throw new BadCredentialsException("Cancelled.");
  			}
  
  			if (verifier == null && stepOne(response, redirectURI, keys)) {
  				return null;
  			} else {
  				userAuth = stepTwo(request, verifier, keys, app);
  			}
  		}
  
  		return SecurityUtils.checkIfActive(userAuth, SecurityUtils.getAuthenticatedUser(userAuth), true);
  	}
docs: Handles an authentication request.
  @param request HTTP request
  @param response HTTP response
  @return an authentication object that contains the principal object if successful.
  @throws IOException ex