anchor.diff:  		// don't let anonymous user log in
   		if(local.user.isAnonymous()) {
   			local.user.logout();
  -			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Anonymous user cannot be set to current user. User: " & local.user.getAccountName()));
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Anonymous user cannot be set to current user. User: " & local.user.getAccountName());
  +			throwError(local.exception);
   		}
   	
   		// don't let disabled users log in
   		if(!local.user.isEnabled()) {
   			local.user.logout();
   			local.user.incrementFailedLoginCount();
  -			local.user.setLastFailedLoginTime(now());
  -			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Disabled user cannot be set to current user. User: " & local.user.getAccountName()));
  +			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Disabled user cannot be set to current user. User: " & local.user.getAccountName());
  +			throwError(local.exception);
   		}
   	
   		// don't let locked users log in
   		if(local.user.isLocked()) {
   			local.user.logout();
   			local.user.incrementFailedLoginCount();
  -			local.user.setLastFailedLoginTime();
  -			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Locked user cannot be set to current user. User: " & local.user.getAccountName()));
  +			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Locked user cannot be set to current user. User: " & local.user.getAccountName());
  +			throwError(local.exception);
   		}
   	
   		// don't let expired users log in
   		if(local.user.isExpired()) {
   			local.user.logout();
   			local.user.incrementFailedLoginCount();
  -			local.user.setLastFailedLoginTime(now());
  -			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException("Login failed", "Expired user cannot be set to current user. User: " & local.user.getAccountName()));
  +			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException("Login failed", "Expired user cannot be set to current user. User: " & local.user.getAccountName());
  +			throwError(local.exception);
   		}
   	
   		// check session inactivity timeout
   		if(local.user.isSessionTimeout()) {
   			local.user.logout();
   			local.user.incrementFailedLoginCount();
  -			local.user.setLastFailedLoginTime(now());
  -			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session inactivity timeout: " & local.user.getAccountName()));
  +			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session inactivity timeout: " & local.user.getAccountName());
  +			throwError(local.exception);
   		}
   	
   		// check session absolute timeout
   		if(local.user.isSessionAbsoluteTimeout()) {
   			local.user.logout();
   			local.user.incrementFailedLoginCount();
  -			local.user.setLastFailedLoginTime(now());
  -			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session absolute timeout: " & local.user.getAccountName()));
  +			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session absolute timeout: " & local.user.getAccountName());
  +			throwError(local.exception);
   		}
   	
   		//set Locale to the user object in the session from request
  
positive.code: 		// else try to verify credentials - throws exception if login fails
  		if(isNull(local.user) || !isInstanceOf(local.user, "cfesapi.org.owasp.esapi.reference.DefaultUser")) {
  			local.user = loginWithUsernameAndPassword(arguments.request);
  
  	        // warn if this authentication request was not POST or non-SSL connection, exposing credentials or session id
  	        try {
  	            instance.ESAPI.httpUtilities().assertSecureRequest(arguments.request);
  	        } catch (cfesapi.org.owasp.esapi.errors.AccessControlException e) {
  	            throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationException(instance.ESAPI, "Attempt to login with an insecure request", e.detail, e));
  	        }
  		}
  
          // if we have a user, verify we are on SSL (POST not required)
          else {
          	        
  	        // warn if this authentication request was non-SSL connection, exposing session id
  	        try {
  	            instance.ESAPI.httpUtilities().assertSecureChannel(arguments.request);
  	        } catch (cfesapi.org.owasp.esapi.errors.AccessControlException e) {
  	            throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationException(instance.ESAPI, "Attempt to access secure content with an insecure request", e.detail, e));
  	        }
          }        
  	
  		// set last host address
  		local.user.setLastHostAddress(arguments.request.getRemoteAddr());
  
negative.code: 	 *         and existing account, or hashed password does not match user's hashed password.
  	 */
  	
  	private function getUserFromRememberToken(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
  		try {
  			local.token = instance.ESAPI.httpUtilities().getCookie(arguments.request, instance.ESAPI.httpUtilities().REMEMBER_TOKEN_COOKIE_NAME);
  			if(local.token == "") {
  