anchor.diff:  
   <% // get parameters
       String username = ParamUtils.getParameter(request, "username");
  -    if (username != null) {
  -        username = JID.escapeNode(username);
  -    }
  -    // Escape HTML tags in username to prevent cross-site scripting attacks. This
  -    // is necessary because we display the username in the page below.
  -    username = org.jivesoftware.util.StringUtils.escapeHTMLTags(username);
   
       String password = ParamUtils.getParameter(request, "password");
       String url = ParamUtils.getParameter(request, "url");
  
positive.code:     Map<String, String> errors = new HashMap<String, String>();
  
      if (ParamUtils.getBooleanParameter(request, "login")) {
          try {
              if (LoginLimitManager.getInstance().hasHitConnectionLimit(username, request.getRemoteAddr())) {
                  throw new UnauthorizedException("User '" + username +"' or address '" + request.getRemoteAddr() + "' has his login attempt limit.");
              }
              if (!AdminManager.getInstance().isUserAdmin(username, true)) {
                  throw new UnauthorizedException("User '" + username + "' not allowed to login.");
              }
              if (secret != null && nodeID != null) {
                  if (StringUtils.hash(AdminConsolePlugin.secret).equals(secret) && ClusterManager.isClusterMember(Base64.decode(nodeID, Base64.URL_SAFE))) {
                      authToken = new AuthToken(username);
                  }
                  else if ("clearspace".equals(nodeID) && ClearspaceManager.isEnabled()) {
                      ClearspaceManager csmanager = ClearspaceManager.getInstance();
                      String sharedSecret = csmanager.getSharedSecret();
                      if (nonce == null || sharedSecret == null || !csmanager.isValidNonce(nonce) ||
                              !StringUtils.hash(username + ":" + sharedSecret + ":" + nonce).equals(secret)) {
                          throw new UnauthorizedException("SSO failed. Invalid secret was provided");
                      }
                      authToken = new AuthToken(username);
                  }
                  else {
                      throw new UnauthorizedException("SSO failed. Invalid secret or node ID was provided");
                  }
              }
              else {
                  authToken = AuthFactory.authenticate(username, password);
              }
              LoginLimitManager.getInstance().recordSuccessfulAttempt(username, request.getRemoteAddr());
              session.setAttribute("jive.admin.authToken", authToken);
              response.sendRedirect(go(url));
              return;
  
negative.code:             errors.put("unauthorized", LocaleUtils.getLocalizedString("login.failed.unauthorized"));
          }
      }
  
      // Escape HTML tags in username to prevent cross-site scripting attacks. This
      // is necessary because we display the username in the page below.
      username = org.jivesoftware.util.StringUtils.escapeHTMLTags(username);
  
  %>
  
  <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
  