anchor.diff:                  }
               }
               else {
  -                authToken = AuthFactory.authenticate(loginUsername, password);
  -            }
  -            LoginLimitManager.getInstance().recordSuccessfulAttempt(loginUsername, request.getRemoteAddr());
  -            session.setAttribute("jive.admin.authToken", authToken);
  -            response.sendRedirect(go(url));
  -            return;
  +                // Check that a username was provided before trying to verify credentials
  +                if (loginUsername != null) {
  +                    if (LoginLimitManager.getInstance().hasHitConnectionLimit(loginUsername, request.getRemoteAddr())) {
  +                        throw new UnauthorizedException("User '" + loginUsername +"' or address '" + request.getRemoteAddr() + "' has his login attempt limit.");
  +                    }
  +                    if (!AdminManager.getInstance().isUserAdmin(loginUsername, true)) {
  +                        throw new UnauthorizedException("User '" + loginUsername + "' not allowed to login.");
  +                    }
  +                    authToken = AuthFactory.authenticate(loginUsername, password);
  +                }
  +                else {
  +                    errors.put("unauthorized", LocaleUtils.getLocalizedString("login.failed.unauthorized"));
  +                }
  +            }
  +            if (errors.isEmpty()) {
  +                LoginLimitManager.getInstance().recordSuccessfulAttempt(loginUsername, request.getRemoteAddr());
  +                session.setAttribute("jive.admin.authToken", authToken);
  +                response.sendRedirect(go(url));
  +                return;
  +            }
           }
           catch (ConnectionException ue) {
               Log.debug(ue);
  
positive.code:     String nonce = ParamUtils.getParameter(request, "nonce");
  
      // The user auth token:
      AuthToken authToken;
  
      // Check the request/response for a login token
  
  
negative.code:             loginUsername = JID.escapeNode(loginUsername);
          }
          try {
              if (secret != null && nodeID != null) {
                  if (StringUtils.hash(AdminConsolePlugin.secret).equals(secret) && ClusterManager.isClusterMember(Base64.decode(nodeID, Base64.URL_SAFE))) {
                      authToken = new AuthToken(loginUsername);
  