@Override
 public UnifiedUser login(String username, String password)
     throws UsernameNotFoundException, BadCredentialsException {
   UnifiedUser user = getByUsername(username);
   if (user == null) {
     throw new UsernameNotFoundException("username not found: " + username);
   }
   if (!pwdEncoder.isPasswordValid(user.getPassword(), password)) {
     throw new BadCredentialsException("password invalid");
   }
   return user;
 }