anchor.diff:  	 * {@inheritDoc}
   	 */
   	
  -	public cfesapi.org.owasp.esapi.User function login(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), 
  -	                                                   cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
  +	public cfesapi.org.owasp.esapi.User function login(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
   	
   		if(isNull(arguments.request) || isNull(arguments.response)) {
  -			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid request", "Request or response objects were null"));
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid request", "Request or response objects were null");
  +			throwError(local.exception);
   		}
   	
   		// if there's a user in the session then use that
  
positive.code: 			if(local.username == "") {
  				local.username = "unspecified user";
  			}
  			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Authentication failed", "Authentication failed for " & local.username & " because of blank username or password"));
  		}
  		local.user = getUserByAccountName(local.username);
  		if(!isObject(local.user)) {
  			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Authentication failed", "Authentication failed because user " & local.username & " doesn't exist"));
  		}
  		local.user.loginWithPassword(arguments.request, local.password);
  	
  
negative.code: 	 *         and existing account, or hashed password does not match user's hashed password.
  	 */
  	
  	private function getUserFromRememberToken(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
  		try {
  			local.token = instance.ESAPI.httpUtilities().getCookie(arguments.request, instance.ESAPI.httpUtilities().REMEMBER_TOKEN_COOKIE_NAME);
  			if(local.token == "") {
  