Fix some bugs in the application spec.
Change MyActionHandler to MyAuthenticationHandler, add some more documentation, add a link back to the "persistent login cookie" best practice.
Make it clearer where the authentication module lies.
Check in a basic password service with bcrypt, add password validation.
Check that pwqcheck call out is working correctly, add some javadoc, sort out the logging a bit.  Add configuration options to tweak pwqcheck options.
Be far more paranoid about incorrect input to BCrypt (it doesn't respond well).
Turn off debug logging, get bonecp to be quiet, fix the specs so everything passes again.