protected boolean isLoginAttempt(ServletRequest request, ServletResponse response) {
        String authzHeader = getAuthzHeader(request);
        return authzHeader != null && isLoginAttempt(authzHeader);
    }
Determines whether the incoming request is an attempt to log in.
<p/>
The default implementation obtains the value of the request's
{@link #AUTHORIZATION_HEADER AUTHORIZATION_HEADER}, and if it is not <code>null</code>, delegates
to {@link #isLoginAttempt(String) isLoginAttempt(authzHeaderValue)}. If the header is <code>null</code>,
<code>false</code> is returned.

@param request  incoming ServletRequest
@param response outgoing ServletResponse
@return true if the incoming request is an attempt to log in based, false otherwise
web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java