}
else if (credentials instanceof String) {
String password = (String) credentials;
Principal user = new BasicPrincipal(to);
PasswordCredentials pwdCred = new PasswordCredentials(password);
if (auth.authenticate(user, pwdCred, null) == null) {
throw new NotAuthorizedException(L.l("'{0}' has invalid password credentials",
to));
}