My suggestion:

* At PicketLinkDefaultUsers remove the line which updates the password

        this.identityManager.add(admin);
        this.identityManager.updateCredential(admin, new Password()); //remove it

* The server will throw an exception with Unauthorized or if you want to 409. Into this way you don't need:

    if(developer.getPassword().equals("123")) {
        return Response.status(Status.CONFLICT).build();
    }