You introduced constants SESSION_ATTR_USER_ID, SESSION_ATTR_PASSWORD and SESSION_ATTR_USER_OBJ. Why are you not using them in this file?

Did you even understood why those constants were introduced? What is there purpose?