in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [543:551]
public boolean isValid(final Credentials credentials) {
String authData = getCookieAuthData(credentials);
if (authData != null) {
return tokenStore.isValid(authData);
}
// no authdata, not valid
return false;
}