public void doGet(HttpRequest req, HttpResponse res) {

		logger.debug("Request received:\n"+req.toVerboseString());

 		//Get the possible query parameters.
		String username = req.getParameter("username");
		String password = req.getParameter("password");
		String logout = req.getParameter("logout");

		//See if this is an ajax call or a web page request
		if (req.getPath().endsWith("/ajax")) {
			//It's an ajax call.
			if (logout == null) {
				res.setResponseCode( login(req, res, username, password) ? 200 : 403 );
				res.send();
			}
			else {
				Authenticator.getInstance().closeSession(req, res);
				res.send();
			}
		}
		else {
			//It's a web page request.
			if (logout == null) {

				//See if it's a direct login
				if ((username != null) && (password != null)) {
					login(req, res, username, password);
					redirect(req, res);
					return;
				}

				//No, see if we are to suppress the login if the
				//user is already authenticated and just go directly
				//to the requested URL (or the default):
				if (req.hasParameter("skip") && req.isFromAuthenticatedUser()) {
					redirect(req, res);
					return;
				}

				//No, display the login page
				String loginPage =
							FileUtil.getText(
								FileUtil.getStream( new File(root, "login.html"), "/login.html" ) );

				//Set the redirect URL for the post.
				Properties props = new Properties();
				String url = req.getParameter("url", "");
				if (isAttack(req, url)) url = "";
				props.put("url", url);
				loginPage = StringUtil.replace(loginPage, props);

				res.write(loginPage);
				res.disableCaching();
				res.setContentType("html");
				res.send();
			}
			else {
				Authenticator.getInstance().closeSession(req, res);
				redirect(req, res);
			}
		}
	}