code: protected void doBasicAuth(Creds credentials, HttpServletRequest request, HttpServletResponse response,
              FilterChain chain) throws IOException, ServletException {
          try {
              if (credentials.username.equals(request.getRemoteUser())) {
                  // Already logged in as this user - do nothing.  This can happen
                  // in some app servers if the app server processes the BASIC auth
                  // credentials before this filter gets a crack at them.  WildFly 8
                  // works this way, for example (despite the web.xml not specifying
                  // any login config!).
              } else if (request.getRemoteUser() != null) {
                  // switch user
                  request.logout();
                  request.login(credentials.username, credentials.password);
              } else {
                  request.login(credentials.username, credentials.password);
              }
          } catch (Exception e) {
              // TODO log this error?
              e.printStackTrace();
              sendAuthResponse(response);
              return;
          }
          doFilterChain(request, response, chain, null);
      }
docs: Handle BASIC authentication.  Delegates this to the container by invoking 'login'
  on the inbound http servlet request object.
  @param credentials the credentials
  @param request the http servlet request
  @param response the http servlet respose
  @param chain the filter chain
  @throws IOException when I/O failure occurs in filter chain
  @throws ServletException when servlet exception occurs during auth