anchor.diff:  			if(local.username == "") {
   				local.username = "unspecified user";
   			}
  -			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Authentication failed", "Authentication failed for " & local.username & " because of blank username or password"));
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Authentication failed", "Authentication failed for " & local.username & " because of blank username or password");
  +			throwError(local.exception);
   		}
   		local.user = getUserByAccountName(local.username);
   		if(!isObject(local.user)) {
  -			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Authentication failed", "Authentication failed because user " & local.username & " doesn't exist"));
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Authentication failed", "Authentication failed because user " & local.username & " doesn't exist");
  +			throwError(local.exception);
   		}
   		local.user.loginWithPassword(arguments.request, local.password);
   	
  
positive.code: 	 * {@inheritDoc}
  	 */
  	
  	public cfesapi.org.owasp.esapi.User function login(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), 
  	                                                   cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
  	
  		if(isNull(arguments.request) || isNull(arguments.response)) {
  			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid request", "Request or response objects were null"));
  		}
  	
  		// if there's a user in the session then use that
  
negative.code: 		// don't let anonymous user log in
  		if(local.user.isAnonymous()) {
  			local.user.logout();
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Anonymous user cannot be set to current user. User: " & local.user.getAccountName());
  			throwError(local.exception);
  		}
  	
  		// don't let disabled users log in
  		if(!local.user.isEnabled()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Disabled user cannot be set to current user. User: " & local.user.getAccountName());
  			throwError(local.exception);
  		}
  	
  		// don't let locked users log in
  		if(local.user.isLocked()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Locked user cannot be set to current user. User: " & local.user.getAccountName());
  			throwError(local.exception);
  		}
  	
  		// don't let expired users log in
  		if(local.user.isExpired()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException("Login failed", "Expired user cannot be set to current user. User: " & local.user.getAccountName());
  			throwError(local.exception);
  		}
  	
  		// check session inactivity timeout
  		if(local.user.isSessionTimeout()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session inactivity timeout: " & local.user.getAccountName());
  			throwError(local.exception);
  		}
  	
  		// check session absolute timeout
  		if(local.user.isSessionAbsoluteTimeout()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(newJava("java.util.Date").init());
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session absolute timeout: " & local.user.getAccountName());
  			throwError(local.exception);
  		}
  	
  		//set Locale to the user object in the session from request
  