in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [885:894]
public String extractAuthenticationInfo(HttpServletRequest request) {
HttpSession session = request.getSession(false);
if (session != null) {
Object attribute = session.getAttribute(sessionAttributeName);
if (attribute instanceof String) {
return (String) attribute;
}
}
return null;
}