protected IPromise<BasicAuthenticationResult> getCredentials(String user, String pw, String jwt) {
        Promise p = new Promise();
        if ( SESSIONID_SPECIAL_STRING.equals(pw) ) {
            sessionStorage.getUserFromSessionId(user).then( (r,e) -> {
                if ( r != null ) {
                    sessionStorage.getUser(r).then( (rec,err) -> {
                        if ( rec != null )
                            getCredentials(rec.getKey(),rec.getString("pwd"), null ).then(p);
                        else
                            p.reject("unknown user");
                    });
                } else {
                    p.reject("authentication failed");
                }
            });
        } else {
            sessionStorage.getUser(user).then((rec, err) -> {
                if (rec == null) {
                    p.reject("wrong user or password");
                } else {
                    if (pw.equals(rec.getString("pwd"))) {
                        if (!rec.getBool("verified")) {
                            // e.g. email verification etc.
                            p.reject("account not verified");
                        } else
                            p.resolve(new BasicAuthenticationResult().userName(rec.getKey()));
                    }
                }
            });
        }
        return p;
    }
protected IPromise < BasicAuthenticationResult > getCredentials ( String user , String pw , String jwt ) { Promise p = new Promise ( ) ; if ( SESSIONID_SPECIAL_STRING . equals ( pw ) ) { sessionStorage . getUserFromSessionId ( user ) . then ( ( r , e ) -> { if ( r != null ) { sessionStorage . getUser ( r ) . then ( ( rec , err ) -> { if ( rec != null ) getCredentials ( rec . getKey ( ) , rec . getString ( "pwd" ) , null ) . then ( p ) ; else p . reject ( "unknown user" ) ; } ) ; } else { p . reject ( "authentication failed" ) ; } } ) ; } else { sessionStorage . getUser ( user ) . then ( ( rec , err ) -> { if ( rec == null ) { p . reject ( "wrong user or password" ) ; } else { if ( pw . equals ( rec . getString ( "pwd" ) ) ) { if ( ! rec . getBool ( "verified" ) ) { p . reject ( "account not verified" ) ; } else p . resolve ( new BasicAuthenticationResult ( ) . userName ( rec . getKey ( ) ) ) ; } } } ) ; } return p ; }
does a lookup for a user record using 'user' as key. Compares pw with 'pwd' of user record if found
if user denotes a vaild old session id and pwd == 'SESSION_ID', a session is created from a previous authentication

@param pw
@param jwt
@return