code: private boolean authenticate(HttpPostCommand command, final String groupName, final String pass)
              throws UnsupportedEncodingException {
          String decodedName = URLDecoder.decode(groupName, "UTF-8");
          SecurityContext securityContext = textCommandService.getNode().getNodeExtension().getSecurityContext();
          if (securityContext == null) {
              final GroupConfig groupConfig = textCommandService.getNode().getConfig().getGroupConfig();
              if (pass != null && !pass.isEmpty()) {
                  logger.fine("Password was provided but the Hazelcast Security is disabled.");
              }
              return groupConfig.getName().equals(decodedName);
          }
          if (pass == null) {
              logger.fine("Empty password is not allowed when the Hazelcast Security is enabled.");
              return false;
          }
          String decodedPass = URLDecoder.decode(pass, "UTF-8");
          UsernamePasswordCredentials credentials = new UsernamePasswordCredentials(groupName, decodedPass);
          try {
              LoginContext lc = securityContext.createMemberLoginContext(credentials);
              lc.login();
          } catch (LoginException e) {
              return false;
          }
          return true;
      }
docs: Checks if the request is valid. If Hazelcast Security is not enabled, then only the given group name is compared to
  configuration. Otherwise member JAAS authentication (member login module stack) is used to authenticate the command.