code: protected CmsObject checkBasicAuthorization(HttpServletRequest req) {
  
          if (LOG.isDebugEnabled()) {
              LOG.debug("Checking for basic authorization.");
          }
          try {
              CmsObject cms = OpenCms.initCmsObject(OpenCms.getDefaultUsers().getUserGuest());
              if (OpenCms.getSystemInfo().getHttpAuthenticationSettings().getBrowserBasedAuthenticationMechanism() == null) {
                  // browser base authorization is not enabled, return Guest user CmsObject
                  if (LOG.isDebugEnabled()) {
                      LOG.debug("Browser based authorization not enabled.");
                  }
                  return cms;
              }
              // no user identified from the session and basic authentication is enabled
              String auth = req.getHeader(HEADER_AUTHORIZATION);
              if ((auth == null) || !auth.toUpperCase().startsWith(AUTHORIZATION_BASIC_PREFIX)) {
                  // no authorization data is available
                  return cms;
              }
              // get encoded user and password, following after "BASIC "
              String base64Token = auth.substring(6);
  
              // decode it, using base 64 decoder
              String token = new String(Base64.decodeBase64(base64Token.getBytes()));
              String username = null;
              String password = null;
              int pos = token.indexOf(SEPARATOR_CREDENTIALS);
              if (pos != -1) {
                  username = token.substring(0, pos);
                  password = token.substring(pos + 1);
              }
              // authentication in the DB
              cms.loginUser(username, password);
  
              // authorization was successful create a session
              req.getSession(true);
              return cms;
          } catch (CmsException e) {
              // authorization failed
              return null;
          }
      }
docs: Checks if the current request contains HTTP basic authentication information in
  the headers, if so the user is tried to log in with this data, and on success a
  session is generated.<p>
  
  @param req the current HTTP request
  
  @return the authenticated cms object, or <code>null</code> if failed