anchor.diff:  	 * jtm - 11/16/2010 - added check to verify pw != username (fix for http://code.google.com/p/owasp-esapi-java/issues/detail?id=108)
   	 */
   	
  -	public void function verifyPasswordStrength(String oldPassword, 
  -	                                            required String newPassword,
  -	                                            required cfesapi.org.owasp.esapi.User user) {
  +	public void function verifyPasswordStrength(String oldPassword, required String newPassword, required cfesapi.org.owasp.esapi.User user) {
   		if(isNull(arguments.newPassword)) {
  -			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid password", "New password cannot be null"));
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid password", "New password cannot be null");
  +			throwError(local.exception);
   		}
   	
   		// can't change to a password that contains any 3 character substring of old password
  
positive.code: 		verifyPasswordStrength(newPassword=arguments.password1, user=local.user);
  	
  		if(!arguments.password1.equals(arguments.password2)) {
  			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Passwords do not match", "Passwords for " & arguments.accountName & " do not match"));
  		}
  	
  		try {
  			setHashedPassword(local.user, hashPassword(arguments.password1, arguments.accountName));
  		}
  		catch(cfesapi.org.owasp.esapi.errors.EncryptionException ee) {
  			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationException(instance.ESAPI, "Internal error", "Error hashing password for " & arguments.accountName, ee));
  		}
  		instance.userMap.put(local.user.getAccountId(), local.user);
  		instance.logger.info(newJava("org.owasp.esapi.Logger").SECURITY_SUCCESS, "New user created: " & arguments.accountName);
  
negative.code: 	 * @param oldHashes a list of the User's old password hashes     *
  	 */
  	
  	public void function setOldPasswordHashes(required cfesapi.org.owasp.esapi.User user, required Array oldHashes) {
  		local.hashes = getAllHashedPasswords(arguments.user, true);
  		if(local.hashes.size() > 1) {
  			local.hashes.removeAll(local.hashes.subList(1, local.hashes.size() - 1));
  		}
  		for(local.i = 1; local.i <= arrayLen(arguments.oldHashes); local.i++) {
  			arrayAppend(local.hashes, arguments.oldHashes[local.i]);
  		}
  		instance.passwordMap.put(arguments.user.getAccountId(), local.hashes);
  