In fact it's checked directly when we call JFactory::getApplication()->login()