关于resin的认证框架

在未logout的情况下，当前的用户无法重新登录成功。查看com.caucho.server.security.FormLogin源代码发现：

	public Principal authenticate(HttpServletRequest request,
			HttpServletResponse response, ServletContext application)
			throws ServletException, IOException
	{
		Principal user = getUserPrincipal(request, response, application);

		if (user != null)
			return user;

		String path = request.getServletPath();
		if (path == null)
			path = request.getPathInfo();
		else if (request.getPathInfo() != null)
			path = path + request.getPathInfo();

		if (path.equals(""))
		{
			// Forward?
			path = request.getContextPath() + "/";
			response.sendRedirect(response.encodeRedirectURL(path));
			return null;
		}

		Application app = (Application) application;

		String uri = request.getRequestURI();

		if (path.endsWith("/j_security_check"))
		{
			...
		}
	}

也就是说，即使用户重新填写登录框并提交至j_security_check，authenticate()还是优先采用已有的用户信息，因此新的认证校验永远不会被调用！