final void getToken(Message message) {
        String[] tokens = message.message.split(",");
        String user = tokens[0];
        String pass = tokens[1];
	String fileHostName = (tokens.length > 3)? tokens[2]: "" ;

        HexString hex = new HexString();
        pass = hex.toHexString(SecurityManager.digest(pass.getBytes()));

        UserRecord record = userData.get(user);
        if(record == null) {
            System.out.println("invalid username: "+user);
            message.message = "invalid username.";
            message.success = false;
        } else if(!record.password.equals(pass)) {
            message.message = "invalid password.";
            message.success = false;
        } else {

            // issue and sign a token if everything was OK:
            List<String> list = new ArrayList<String>(record.groups.size());
            list.addAll(record.groups);
            Token t = new Token(GroupServer.getHostName(), user, fileHostName, list);
            SecurityManager.getInstance().signToken(t);
            
            message.token = t;
            message.success = true;
            message.message = "token granted.";
        }
    }