Yes, I also had the same understanding, but there is a legacy code in our application which is validating it with the password. As checked in Security -> Users, Its a System user account, but then the code is also validating this user with a password through j_security_checkWas confused, so raised a...