code: @Override
      public void contextInitialized(ServletContextEvent evt) {
          File usersDir = new File(SetupOptions.getBaseConfigDirectory(), "users");
          if (!usersDir.isDirectory()) {
              return;
          }
          DocumentBuilder domBuilder = null;
          try {
              domBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
          } catch (ParserConfigurationException e) {
              LOGR.warning(e.getMessage());
              return;
          }
          DOMImplementationLS lsFactory = buildDOM3LoadAndSaveFactory();
          LSSerializer serializer = lsFactory.createLSSerializer();
          serializer.getDomConfig().setParameter(Constants.DOM_XMLDECL, Boolean.FALSE);
          serializer.getDomConfig().setParameter(Constants.DOM_FORMAT_PRETTY_PRINT, Boolean.TRUE);
          LSOutput output = lsFactory.createLSOutput();
          output.setEncoding("UTF-8");
          for (File userDir : usersDir.listFiles()) {
              File userFile = new File(userDir, "user.xml");
              if (!userFile.isFile()) {
                  continue;
              }
              try {
                  Document doc = domBuilder.parse(userFile);
                  Node pwNode = doc.getElementsByTagName("password").item(0);
                  if (null == pwNode) {
                      continue;
                  }
                  String password = pwNode.getTextContent();
                  if (password.split(":").length == 5) {
                      break;
                  }
                  pwNode.setTextContent(PasswordStorage.createHash(password));
                  // overwrite contents of file
                  // Fortify Mod: Make sure that the output stream is closed
                  // output.setByteStream(new FileOutputStream(userFile, false));
                  FileOutputStream os = new FileOutputStream(userFile, false);
                  output.setByteStream(os);
                  serializer.write(doc, output);
                  os.close();
              } catch (Exception e) {
                  LOGR.info(e.getMessage());
                  continue;
              }
          }
      }
docs: Checks that passwords in the user files are not in clear text. If a hash
  value is found for some user, it is assumed that all user passwords have
  previously been hashed and no further checks are done.