code: private Credentials getCredentials(HttpServletRequest request,
              String username, String password) {
  
          // If no username/password given, try Authorization header
          if (username == null && password == null) {
  
              String authorization = request.getHeader("Authorization");
              if (authorization != null && authorization.startsWith("Basic ")) {
  
                  try {
  
                      // Decode base64 authorization
                      String basicBase64 = authorization.substring(6);
                      String basicCredentials = new String(
                              BaseEncoding.base64().decode(basicBase64), "UTF-8");
  
                      // Pull username/password from auth data
                      int colon = basicCredentials.indexOf(':');
                      if (colon != -1) {
                          username = basicCredentials.substring(0, colon);
                          password = basicCredentials.substring(colon + 1);
                      }
                      else
                          logger.debug("Invalid HTTP Basic \"Authorization\" header received.");
  
                  }
  
                  // UTF-8 support is required by the Java specification
                  catch (UnsupportedEncodingException e) {
                      throw new UnsupportedOperationException("Unexpected lack of UTF-8 support.", e);
                  }
  
              }
  
          } // end Authorization header fallback
  
          // Build credentials
          return new Credentials(username, password, request);
  
      }
docs: Returns the credentials associated with the given request, using the
  provided username and password.
  
  @param request
  The request to use to derive the credentials.
  
  @param username
  The username to associate with the credentials, or null if the
  username should be derived from the request.
  
  @param password
  The password to associate with the credentials, or null if the
  password should be derived from the request.
  
  @return
  A new Credentials object whose contents have been derived from the
  given request, along with the provided username and password.