anchor.diff:  	 * {@inheritDoc}
   	 */
   	
  -	public cfesapi.org.owasp.esapi.User function login(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), 
  -	                                                   cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
  +	public cfesapi.org.owasp.esapi.User function login(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
   	
   		if(isNull(arguments.request) || isNull(arguments.response)) {
  -			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid request", "Request or response objects were null"));
  +			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid request", "Request or response objects were null");
  +			throwError(local.exception);
   		}
   	
   		// if there's a user in the session then use that
  
positive.code: 		// don't let anonymous user log in
  		if(local.user.isAnonymous()) {
  			local.user.logout();
  			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Anonymous user cannot be set to current user. User: " & local.user.getAccountName()));
  		}
  	
  		// don't let disabled users log in
  		if(!local.user.isEnabled()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(now());
  			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Disabled user cannot be set to current user. User: " & local.user.getAccountName()));
  		}
  	
  		// don't let locked users log in
  		if(local.user.isLocked()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime();
  			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Locked user cannot be set to current user. User: " & local.user.getAccountName()));
  		}
  	
  		// don't let expired users log in
  		if(local.user.isExpired()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(now());
  			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException("Login failed", "Expired user cannot be set to current user. User: " & local.user.getAccountName()));
  		}
  	
  		// check session inactivity timeout
  		if(local.user.isSessionTimeout()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(now());
  			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session inactivity timeout: " & local.user.getAccountName()));
  		}
  	
  		// check session absolute timeout
  		if(local.user.isSessionAbsoluteTimeout()) {
  			local.user.logout();
  			local.user.incrementFailedLoginCount();
  			local.user.setLastFailedLoginTime(now());
  			throwError( new cfesapi.org.owasp.esapi.errors.AuthenticationLoginException(instance.ESAPI, "Login failed", "Session absolute timeout: " & local.user.getAccountName()));
  		}
  	
  		//set Locale to the user object in the session from request
  
negative.code: 	 *         and existing account, or hashed password does not match user's hashed password.
  	 */
  	
  	private function getUserFromRememberToken(cfesapi.org.owasp.esapi.HttpServletRequest request=instance.ESAPI.currentRequest(), cfesapi.org.owasp.esapi.HttpServletResponse response=instance.ESAPI.currentResponse()) {
  		try {
  			local.token = instance.ESAPI.httpUtilities().getCookie(arguments.request, instance.ESAPI.httpUtilities().REMEMBER_TOKEN_COOKIE_NAME);
  			if(local.token == "") {
  