anchor.diff:  				user.setLastFailedLoginTime(newJava("java.util.Date").init());
   				throwException(createObject("component", "org.owasp.esapi.errors.AuthenticationLoginException").init(variables.ESAPI, "Login failed", "Session absolute timeout: " & user.getAccountName()));
   			}
  -		
  +
   			// create new session for this User
   			httpSession = arguments.httpRequest.getSession();
   			user.addSession(httpSession);
  
positive.code: 				throwException(createObject("component", "org.owasp.esapi.errors.AuthenticationException").init(variables.ESAPI, "Password change failed", "Encryption exception changing password for " & accountName, ee));
  			}
  		</cfscript>
  		
  	</cffunction>
  	
  	<cffunction access="public" returntype="boolean" name="verifyPassword" output="false">
  		<cfargument required="true" type="org.owasp.esapi.User" name="user"/>
  		<cfargument required="true" type="String" name="password"/>
  	
  		<cfscript>
  			// CF8 requires 'var' at the top
  			var attemptedHash = "";
  			var currentHash = "";
  		
  			var accountName = arguments.user.getAccountName();
  			try {
  				attemptedHash = hashPassword(arguments.password, accountName);
  
negative.code: 			}
  			return 0;
  		</cfscript>
  
  	</cffunction>
  
  </cfcomponent>