anchor.diff:  				user.setLastFailedLoginTime(newJava("java.util.Date").init());
   				throwException(createObject("component", "org.owasp.esapi.errors.AuthenticationLoginException").init(variables.ESAPI, "Login failed", "Session absolute timeout: " & user.getAccountName()));
   			}
  -		
  +
   			// create new session for this User
   			httpSession = arguments.httpRequest.getSession();
   			user.addSession(httpSession);
  
positive.code: 
  	<cfscript>
  		variables.ESAPI = "";
  	
  		/** Key for user in session */
  		variables.USER = "ESAPIUserSessionKey";
  	
  		/** The logger. */
  		variables.logger = "";
  	
  		/** The file that contains the user db */
  		variables.userDB = "";
  	
  		/** How frequently to check the user db for external modifications */
  		variables.checkInterval = 60 * 1000;
  	
  		/** The last modified time we saw on the user db. */
  		variables.lastModified = 0;
  	
  		/** The last time we checked if the user db had been modified externally */
  		variables.lastChecked = 0;
  	
  		variables.MAX_ACCOUNT_NAME_LENGTH = 250;
  	</cfscript>
  	
  	<cffunction access="public" returntype="void" name="setHashedPassword" output="false"
  	            hint="Add a hash to a User's hashed password list.  This method is used to store a user's old password hashes to be sure that any new passwords are not too similar to old passwords.">
  		<cfargument required="true" type="org.owasp.esapi.User" name="user" hint="the user to associate with the new hash"/>
  		<cfargument required="true" type="String" name="hash" hint="the hash to store in the user's password hash list"/>
  	
  		<cfscript>
  			var hashes = getAllHashedPasswords(arguments.user, true);
  			arrayPrepend(hashes, arguments.hash);
  
negative.code: 				throwException(createObject("component", "org.owasp.esapi.errors.AuthenticationCredentialsException").init(variables.ESAPI, "Invalid account name", "New account name is not valid: " & arguments.accountName));
  			}
  		</cfscript>
  
  	</cffunction>
  
  	<cffunction access="public" returntype="void" name="verifyPasswordStrength" output="false"
  	            hint="This implementation checks: - for any 3 character substrings of the old password - for use of a length character sets &gt; 16 (where character sets are upper, lower, digit, and special">
  		<cfargument type="String" name="oldPassword"/>
  		<cfargument required="true" type="String" name="newPassword"/>
  
  		<cfscript>
  			// CF8 requires 'var' at the top
  			var length = "";
  