protected String getPassword(ServletRequest request) {
        return WebUtils.getCleanParam(request, getPasswordParam());
    }
This default implementation merely returns <code>true</code> if the request is an HTTP <code>POST</code>,
<code>false</code> otherwise. Can be overridden by subclasses for custom login submission detection behavior.

@param request  the incoming ServletRequest
@param response the outgoing ServletResponse.
@return <code>true</code> if the request is an HTTP <code>POST</code>, <code>false</code> otherwise.
web/src/main/java/org/apache/shiro/web/filter/authc/FormAuthenticationFilter.java