code: private CmsObject initCmsObject(
          HttpServletRequest req,
          HttpServletResponse res,
          String user,
          String password,
          String ouFqn)
      throws CmsException {
  
          String siteroot = null;
          // gather information from request if provided
          if (req != null) {
              siteroot = OpenCms.getSiteManager().matchRequest(req).getSiteRoot();
          }
          // initialize the user
          if (user == null) {
              user = getDefaultUsers().getUserGuest();
          }
          if (siteroot == null) {
              siteroot = "/";
          }
          CmsObject cms = initCmsObject(
              req,
              m_securityManager.readUser(null, user),
              siteroot,
              CmsProject.ONLINE_PROJECT_ID,
              ouFqn);
          // login the user if different from Guest and password was provided
          if ((password != null) && !getDefaultUsers().isUserGuest(user)) {
              cms.loginUser(user, password, CmsContextInfo.LOCALHOST);
          }
          return cms;
      }
docs: Returns an initialized CmsObject with the given users permissions.<p>
  
  In case the password is <code>null</code>, or the user is the <code>Guest</code> user,
  no password check is done. Therefore you can initialize all users without knowing their passwords
  by just supplying <code>null</code> as password. This is intended only for
  internal operation in the core.<p>
  
  @param req the current request
  @param res the current response
  @param user the user to initialize the CmsObject with
  @param password the password of the user
  @param ouFqn the organizational unit, if <code>null</code> the users ou is used
  
  @return a cms context that has been initialized with "Guest" permissions
  
  @throws CmsException in case the CmsObject could not be initialized