anchor.diff:  		local.request = new cfesapi.test.org.owasp.esapi.http.MockHttpServletRequest();
   		local.response = new cfesapi.test.org.owasp.esapi.http.MockHttpServletResponse();
   		instance.ESAPI.httpUtilities().setCurrentHTTP(local.request, local.response);
  +	
  +		newJava("java.lang.System").out.println("getUserFromRememberToken - expecting failure");
  +		local.request.setCookie(instance.ESAPI.httpUtilities().REMEMBER_TOKEN_COOKIE_NAME, "ridiculous");
  +		try {
  +			local.authenticator.login(local.request, local.response);// wrong cookie will fail
  +		}
  +		catch(cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException e) {
  +			// expected
  +		}
   		
  -		newJava("java.lang.System").out.println("getUserFromRememberToken - expecting failure");
  -		local.request.setCookie( instance.ESAPI.httpUtilities().REMEMBER_TOKEN_COOKIE_NAME, "ridiculous" );
  -		try {
  -			local.authenticator.login( local.request, local.response );  // wrong cookie will fail
  -		} catch( cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException e ) {
  -			// expected
  -		}
  -
   		newJava("java.lang.System").out.println("getUserFromRememberToken - expecting success");
   		local.request = new cfesapi.test.org.owasp.esapi.http.MockHttpServletRequest();
   		instance.ESAPI.httpUtilities().setCurrentHTTP(local.request, local.response);
   		instance.ESAPI.authenticator().setCurrentUser(local.user);
  -		local.newToken = instance.ESAPI.httpUtilities().setRememberToken(local.request, local.response, local.password, 10000, "test.com", local.request.getContextPath() );
  -		local.request.setCookie( instance.ESAPI.httpUtilities().REMEMBER_TOKEN_COOKIE_NAME, local.newToken );
  -        local.user.logout();  // logout the current user so we can log them in with the remember cookie
  -		local.test2 = local.authenticator.login( local.request, local.response );
  -		assertSame( local.user, local.test2 );
  -	}
  -	
  -
  +		local.newToken = instance.ESAPI.httpUtilities().setRememberToken(local.request, local.response, local.password, 10000, "test.com", local.request.getContextPath());
  +		local.request.setCookie(instance.ESAPI.httpUtilities().REMEMBER_TOKEN_COOKIE_NAME, local.newToken);
  +		local.user.logout();// logout the current user so we can log them in with the remember cookie
  +		local.test2 = local.authenticator.login(local.request, local.response);
  +		assertSame(local.user, local.test2);
  +	}
   	
   	/**
   	 * Test get user from session.
  
positive.code: 	 * @throws AuthenticationException
  	 *             the authentication exception
  	 */
  	public void function testSetCurrentUser() {
  		newJava("java.lang.System").out.println("setCurrentUser");
          local.authenticator = instance.ESAPI.authenticator();
  		local.user1 = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_UPPERS);
  		local.user2 = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_UPPERS);
  		local.userOne = local.authenticator.createUser(local.user1, "getCurrentUser", "getCurrentUser");
  		local.userOne.enable();
  	    local.request = new cfesapi.test.org.owasp.esapi.http.MockHttpServletRequest();
  		local.response = new cfesapi.test.org.owasp.esapi.http.MockHttpServletResponse();
  		instance.ESAPI.httpUtilities().setCurrentHTTP(local.request, local.response);
  		local.userOne.loginWithPassword(password="getCurrentUser");
  		local.currentUser = local.authenticator.getCurrentUser();
  		assertEquals( local.currentUser, local.userOne );
  		local.userTwo = local.authenticator.createUser(local.user2, "getCurrentUser", "getCurrentUser");		
  		local.authenticator.setCurrentUser( local.userTwo );
  		assertFalse( local.currentUser.getAccountName() == local.userTwo.getAccountName() );
  		
  		/* TODO: make this work too!
  		Runnable echo = new Runnable() {
  			private int count = 1;
  			public void run() {
  				User u=null;
  				try {
  					local.password = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_ALPHANUMERICS);
  					u = local.authenticator.createUser("test" & count++, local.password, local.password);
  					local.authenticator.setCurrentUser(u);
  					instance.ESAPI.getLogger("test").info( Logger.SECURITY_SUCCESS, "Got current user" );
  					// instance.ESAPI.authenticator().removeUser( u.getAccountName() );
  				} catch (cfesapi.org.owasp.esapi.errors.AuthenticationException e) {
  					e.printStackTrace();
  				}
  			}
  		};
  		for ( int i = 0; i<10; i++ ) {
  			new Thread( echo ).start();
  		}*/
  	}
  	
  
  	/**
  	 * Test of setCurrentUser method, of class org.owasp.esapi.Authenticator.
  	 * 
  	 * @throws AuthenticationException
  	 *             the authentication exception
  	 */
  	public void function testSetCurrentUserWithRequest() {
  		newJava("java.lang.System").out.println("setCurrentUser(req,resp)");
          local.authenticator = instance.ESAPI.authenticator();
          local.authenticator.logout();  // in case anyone is logged in
  		local.password = local.authenticator.generateStrongPassword();
  		local.accountName = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_ALPHANUMERICS);
  		local.user = local.authenticator.createUser(local.accountName, local.password, local.password);
  
negative.code: 	 * @throws AuthenticationException
  	 *             the authentication exception
  	 */
  	
  	public void function testGenerateStrongPassword() {
  		newJava("java.lang.System").out.println("generateStrongPassword");
  		local.authenticator = instance.ESAPI.authenticator();
  		local.oldPassword = "iiiiiiiiii";// i is not allowed in passwords - this prevents failures from containing pieces of old password
  		local.newPassword = "";
  		local.username = "FictionalEsapiUser";
  		local.user = new cfesapi.org.owasp.esapi.reference.DefaultUser(instance.ESAPI, local.username);
  		for(local.i = 0; local.i < 100; local.i++) {
  			try {
  				local.newPassword = local.authenticator.generateStrongPassword();
  				local.authenticator.verifyPasswordStrength(local.oldPassword, local.newPassword, local.user);
  			}
  			catch(cfesapi.org.owasp.esapi.errors.AuthenticationException e) {
  				newJava("java.lang.System").out.println("  FAILED >> " & local.newPassword & " : " & e.getLogMessage());
  				fail();
  			}
  		}
  		try {
  			local.authenticator.verifyPasswordStrength("test56^$test", "abcdx56^$sl", local.user);
  		}
  		catch(cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException e) {
  			// expected
  		}
  	}
  	
  	/**
  	 * Test of getCurrentUser method, of class org.owasp.esapi.Authenticator.
  	 * 
  	 *
  	 * @throws Exception
  	 */
  	
  	public void function testGetCurrentUser() {
  		newJava("java.lang.System").out.println("getCurrentUser");
  		local.authenticator = instance.ESAPI.authenticator();
  		local.username1 = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_ALPHANUMERICS);
  		local.username2 = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_ALPHANUMERICS);
  		local.user1 = local.authenticator.createUser(local.username1, "getCurrentUser", "getCurrentUser");
  		local.user2 = local.authenticator.createUser(local.username2, "getCurrentUser", "getCurrentUser");
  		local.user1.enable();
  		local.request = new cfesapi.test.org.owasp.esapi.http.MockHttpServletRequest();
  		local.response = new cfesapi.test.org.owasp.esapi.http.MockHttpServletResponse();
  		instance.ESAPI.httpUtilities().setCurrentHTTP(local.request, local.response);
  		local.user1.loginWithPassword(password="getCurrentUser");
  		local.currentUser = local.authenticator.getCurrentUser();
  		assertEquals(local.currentUser, local.user1);
  		local.authenticator.setCurrentUser(user=local.user2);
  		assertFalse(local.currentUser.getAccountName() == local.user2.getAccountName());
  	
  		/* TODO: make this work too!
  		Runnable echo = new Runnable() {
  		    private int count = 1;
  		    private boolean result = false;
  		    public void run() {
  		        Authenticator auth = instance.ESAPI.authenticator();
  		        User a = null;
  		        try {
  		            String password = auth.generateStrongPassword();
  		            local.accountName = "TestAccount" & count++;
  		            a = auth.getUser(local.accountName);
  		            if ( a != null ) {
  		                auth.removeUser(local.accountName);
  		            }
  		            a = auth.createUser(local.accountName, password, password);
  		            auth.setCurrentUser(a);
  		        } catch (cfesapi.org.owasp.esapi.errors.AuthenticationException e) {
  		            e.printStackTrace();
  		        }
  		        User b = auth.getCurrentUser();
  		        result &= a.equals(b);
  		    }
  		};
  		ThreadGroup tg = new ThreadGroup("test");
  		for ( int i = 0; i<10; i++ ) {
  		    new Thread( tg, echo ).start();
  		}
  		while (tg.activeCount() > 0 ) {
  		    Thread.sleep(100);
  		}*/
  	}
  	
  	/**
  	 * Test of getUser method, of class org.owasp.esapi.Authenticator.
  	 * 
  	 * @throws AuthenticationException
  	 *             the authentication exception
  	 */
  	
  	public void function testGetUser() {
  		newJava("java.lang.System").out.println("getUser");
  		local.authenticator = instance.ESAPI.authenticator();
  		local.password = local.authenticator.generateStrongPassword();
  		local.accountName = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_ALPHANUMERICS);
  		local.authenticator.createUser(local.accountName, local.password, local.password);
  		assertTrue(isObject(local.authenticator.getUserByAccountName(local.accountName)));
  		assertFalse(isObject(local.authenticator.getUserByAccountName(instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_ALPHANUMERICS))));
  	}
  	
  	/**
  	 *
  	 * @throws org.owasp.esapi.errors.AuthenticationException
  	 */
  	
  	public void function testGetUserFromRememberToken() {
  		newJava("java.lang.System").out.println("getUserFromRememberToken");
  		local.authenticator = instance.ESAPI.authenticator();
  		local.authenticator.logout();// in case anyone is logged in
  		local.password = local.authenticator.generateStrongPassword();
  		local.accountName = instance.ESAPI.randomizer().getRandomString(8, newJava("org.owasp.esapi.reference.DefaultEncoder").CHAR_ALPHANUMERICS);
  		local.user = local.authenticator.createUser(local.accountName, local.password, local.password);
  