// Note if topsecret implied basic we would not have to add it here.
// Also we only need this because we can login through a
// bookmarkable url, thereby bypassing the first login page.
// if we know we always come through the first loginpage we can
// remove basic here.
subject.addPrincipal(new MyPrincipal("basic"));
subject.addPrincipal(new MyPrincipal("topsecret"));
return subject;
}
throw new LoginException("username does not match token");
}