FormLogin/Everyone doesn't authenticate correctly

Hey,

Whenever, the user log out or get timed out, it redirects him to the FormLogin/Everyone.

However, on that FormLogin, it gets the username (not the password) and log the user as what the username is even if the password is wrong.

I have a custom authenticator, could that be it or is it a problem with the FormLogin ?

Here is my Custom Authenticator

import java.io.IOException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import com.thingworx.security.authentication.AuthenticatorException;
import com.thingworx.security.authentication.CustomAuthenticator;
public class LoginAuthenticator extends CustomAuthenticator {
    private String user;
    private String requestUrl;
    private String password;
    private boolean isFormLogin;
    private boolean isRedirect;
public LoginAuthenticator() {
        user = null;
        requestUrl = null;
        password = null;
        isFormLogin = true;
        isRedirect = false;
}
@Override
    public boolean matchesAuthRequest(HttpServletRequest httpRequest)
            throws AuthenticatorException
        {
            requestUrl = httpRequest.getRequestURL().toString();
            if((!requestUrl.contains("action-login")) & (!requestUrl.contains("FormLogin")))
            {
                isFormLogin = false;
                isRedirect = true;
                setRequiresChallenge(true);
            } else
            if(requestUrl.contains("action-login"))
            {
                user = httpRequest.getParameter("thingworx-form-userid");
                password = httpRequest.getParameter("thingworx-form-password");
            }
            return true;
        }
     
@Override
   public void authenticate(HttpServletRequest httpRequest, HttpServletResponse httpResponse)
        throws AuthenticatorException
    {
        setCredentials(user, password);
    }
@Override
   public void issueAuthenticationChallenge(HttpServletRequest httpRequest, HttpServletResponse httpResponse)
        throws AuthenticatorException
    {
        if(isRedirect)
        {
            String urlString = "/Thingworx/FormLogin/Everyone";//replace with your own organization
            try
            {
                httpResponse.sendRedirect(urlString);
            }
            catch(IOException e)
            {
                e.printStackTrace();
            }
        }
    }
}