code: public String validate(String user, String password) throws IOException, CadiException {
  		User<AAFPermission> usr = getUser(user);
  		if(password.startsWith("enc:???")) {
  			password = access.decrypt(password, true);
  		}
  
  		byte[] bytes = password.getBytes();
  		if(usr != null && usr.principal != null && usr.principal.getName().equals(user) 
  				&& usr.principal instanceof GetCred) {
  			
  			if(Hash.isEqual(((GetCred)usr.principal).getCred(),bytes)) {
  				return null;
  			} else {
  				remove(usr);
  				usr = null;
  			}
  		}
  		
  		AAFCachedPrincipal cp = new AAFCachedPrincipal(this,con.app, user, bytes, con.cleanInterval);
  		// Since I've relocated the Validation piece in the Principal, just revalidate, then do Switch
  		// Statement
  		switch(cp.revalidate()) {
  			case REVALIDATED:
  				if(usr!=null) {
  					usr.principal = cp;
  				} else {
  					addUser(new User<AAFPermission>(cp,con.timeout));
  				}
  				return null;
  			case INACCESSIBLE:
  				return "AAF Inaccessible";
  			case UNVALIDATED:
  				return "User/Pass combo invalid for " + user;
  			case DENIED:
  				return "AAF denies API for " + user;
  			default: 
  				return "AAFAuthn doesn't handle Principal " + user;
  		}
  	}
docs: Returns null if ok, or an Error String;
  
  @param user
  @param password
  @return
  @throws IOException
  @throws CadiException
  @throws Exception