class DefaultSecurityManager implements SecurityManager {

    @Override
    public void login(HttpServletRequest request, String username, String password) throws ServletException {

        if (logins.containsKey(username) && password != null && password.equals(logins.get(username))) {
            DefaultWebApplicationRequest abstractRequest;

            while (request instanceof HttpServletRequestWrapper) {
                HttpServletRequestWrapper wrapper = (HttpServletRequestWrapper) request;
                request = (HttpServletRequest) wrapper.getRequest();
            }
            abstractRequest = (DefaultWebApplicationRequest) request;
            abstractRequest.setUserPrincipal(new DefaultSecurityPrincipal(username));
        } else {
            throw new ServletException("Unable to login using the given username and password");
        }
    }

}