anchor.diff:  			}
   			throwException(createObject("java", "java.lang.RuntimeException").init("No hashes found for " & arguments.user.getAccountName() & ". Is User.hashcode() and equals() implemented correctly?"));
   		</cfscript>
  -		
  -	</cffunction>
  -	
  +
  +	</cffunction>
  +
   	<cffunction returntype="Array" name="getOldPasswordHashes" output="false" hint="Get a List of the specified User's old password hashes.  This will not return the User's current password hash.">
   		<cfargument required="true" type="org.owasp.esapi.User" name="user" hint="the user whose old password hashes should be returned"/>
  -	
  +
   		<cfscript>
   			var hashes = getAllHashedPasswords(arguments.user, false);
   			if(hashes.size() > 1) {
  
positive.code: 			}
  			return user;
  		</cfscript>
  		
  	</cffunction>
  	
  	<cffunction access="public" name="getUserByAccountId" output="false">
  		<cfargument required="true" type="numeric" name="accountId"/>
  	
  		<cfscript>
  			if(arguments.accountId == 0) {
  				return createObject("component", "org.owasp.esapi.User$ANONYMOUS").init(variables.ESAPI);
  
negative.code: 				user.setLastFailedLoginTime(newJava("java.util.Date").init());
  				throwException(createObject("component", "org.owasp.esapi.errors.AuthenticationLoginException").init(variables.ESAPI, "Login failed", "Expired user cannot be set to current user. User: " & user.getAccountName()));
  			}
  
  			// check session inactivity timeout
  			if(user.isSessionTimeout()) {
  				user.logout();
  