in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [301:303]
public void dropCredentials(HttpServletRequest request, HttpServletResponse response) { authStorage.clear(request, response); }