in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [897:902]
public void set(HttpServletRequest request, HttpServletResponse response, String authData,
AuthenticationInfo info) {
// store the auth hash as a session attribute
HttpSession session = request.getSession();
session.setAttribute(sessionAttributeName, authData);
}