rolled back from j_security authentication