private void check_aauth(WebauthRequest request, WebauthResponse response)
			throws WebauthException {

		Collection<String> aauth = request.getColl("aauth");

		if (aauth == null || aauth.isEmpty())
			return;

		String auth = response.get("auth");
		Collection<String> sso = response.getColl("sso");
		for (String next : aauth) {
			if (auth.equals(next) || sso.contains(next)) {
				return;
			}
		}
		throw new WebauthException("No acceptable authentication types used");
	}