code: @Override
      protected boolean validatePassword(String inputPassword, String expectedPassword) {
      	boolean verifyOK = false;
      	for(;;) { // single point of exit
  	        if (inputPassword == null || expectedPassword == null) {
  	            break;
  	        }
  	
  	        PBKDF2Parameters p = getEngineParameters();
  	        if( p == null ) {
  	            break;
  	        }
  	
  	        PBKDF2Formatter f = getFormatter();
  	        if( f == null ) {
  	            break;
  	        }
  
  	        if (f.fromString(p, expectedPassword)) {
  	            break;
  	        }
  
  	        PBKDF2 pBKDF2Engine = getEngine(p);
  	        if( pBKDF2Engine == null ) {
  	            break;
  	        }
  	        verifyOK = pBKDF2Engine.verifyKey(inputPassword);
  	        break;
      	}
          return verifyOK;
      }
docs: Actual salt-enabled verification function. Get parameters from database
  'password', then compute candidate derived key from user-supplied
  password and parameters, then compare database derived key and candidate
  derived key. Login if match.
  
  @param inputPassword
  Password that was supplied by user (candidate password)
  @param expectedPassword
  Actually the encoded PBKDF2 string which contains the
  expected/reference password implicitly. Not a clear-text
  password. Parameter is named like this because of inherited
  method parameter name.
  @return <code>true</code> if the inputPassword is valid, <code>false</code> otherwise.