code: @Override
      protected void doAuthenticate(final HttpServletRequest _request,
                                    final HttpServletResponse _response,
                                    final FilterChain _chain)
          throws IOException, ServletException
      {
          final String header = _request.getHeader("Authorization");
  
          if (header == null) {
              _response.setHeader("WWW-Authenticate", "Basic realm=\"" + this.title + "\"");
              _response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
          } else {
              final String encoded = header.substring(header.indexOf(" ") + 1);
              final String decoded = new String(Base64.decodeBase64(encoded.getBytes()), "UTF8");
              final String name = decoded.substring(0, decoded.indexOf(":"));
              final String passwd = decoded.substring(decoded.indexOf(":") + 1);
              if (checkLogin(name, passwd)) {
                  setLoggedInUser(_request, name);
                  _chain.doFilter(_request, _response);
              } else {
                  _response.setHeader("WWW-Authenticate", "Basic realm=\"" + this.title + "\"");
                  _response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
              }
          }
      }
docs: If the user does not make authentication, the header for basic
  authentication is sent to the client. After the client makes the
  authentication, the name and password is checked with method
  {@link AbstractAuthenticationFilter#checkLogin}.<br/>
  If the authentication fails, the header for basic authentication is sent
  again to the used, otherwise the nothing is filtered anymore.
  @param _request      HttpServletRequest
  @param _response     HttpServletResponse
  @param _chain        FilterChain
  @throws IOException on error
  @throws ServletException on error