protected Object getSubmittedPassword(AuthenticationToken token) {
        return token != null ? token.getCredentials() : null;
    }
A {@link CredentialsMatcher} that employs best-practices comparisons for hashed text passwords.
<p/>
This implementation delegates to an internal {@link PasswordService} to perform the actual password
comparison.  This class is essentially a bridge between the generic CredentialsMatcher interface and the
more specific {@code PasswordService} component.

@since 1.2
core/src/main/java/org/apache/shiro/authc/credential/PasswordMatcher.java