anchor.diff:  	 * @param hash the hash to store in the user's password hash list
   	 */
   	
  -	private void function setHashedPassword(required cfesapi.org.owasp.esapi.User user, 
  -	                                        required String hash) {
  +	private void function setHashedPassword(required cfesapi.org.owasp.esapi.User user, required String hash) {
   		local.hashes = getAllHashedPasswords(arguments.user, true);
   		arrayPrepend(local.hashes, arguments.hash);
   		if(local.hashes.size() > instance.ESAPI.securityConfiguration().getMaxOldPasswordHashes()) {
  
positive.code: 		}
  		catch(java.io.IOException e) {
  			instance.logger.fatal(newJava("org.owasp.esapi.Logger").SECURITY_FAILURE, "Problem saving user file " & instance.userDB.getAbsolutePath(), e);
  			throwError(new cfesapi.org.owasp.esapi.errors.AuthenticationException(instance.ESAPI, "Internal Error", "Problem saving user file " & instance.userDB.getAbsolutePath(), e));
  		}
  		finally
  		{
  
negative.code: 	 * {@inheritDoc}
  	 */
  	
  	public cfesapi.org.owasp.esapi.User function createUser(required String accountName, required String password1, required String password2) {
  		loadUsersIfNecessary();
  		if(trim(arguments.accountName) == "") {
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationAccountsException(instance.ESAPI, "Account creation failed", "Attempt to create user with blank accountName");
  			throwError(local.exception);
  		}
  		if(isObject(getUserByAccountName(arguments.accountName))) {
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationAccountsException(instance.ESAPI, "Account creation failed", "Duplicate user creation denied for " & arguments.accountName);
  			throwError(local.exception);
  		}
  	
  		verifyAccountNameStrength(arguments.accountName);
  	
  		if(trim(arguments.password1) == "") {
  			local.exception = new cfesapi.org.owasp.esapi.errors.AuthenticationCredentialsException(instance.ESAPI, "Invalid account name", "Attempt to create account " & arguments.accountName & " with a blank password");
  			throwError(local.exception);
  		}
  	
  		local.user = new DefaultUser(instance.ESAPI, arguments.accountName);
  