in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [313:326]
public void authenticationFailed(HttpServletRequest request, HttpServletResponse response,
AuthenticationInfo authInfo) {
/*
* Note: This method is called if this handler provided credentials which cause
* a login failure
*/
// clear authentication data from Cookie or Http Session
authStorage.clear(request, response);
// signal the reason for login failure
request.setAttribute(FAILURE_REASON, FormReason.INVALID_CREDENTIALS);
}