in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [414:417]
private boolean ignoreRequestCredentials(final HttpServletRequest request) {
final String requestLogin = request.getParameter(REQUEST_LOGIN_PARAMETER);
return requestLogin != null && !HttpServletRequest.FORM_AUTH.equals(requestLogin);
}