Major Description
The PropertiesFileLoginModule throws an assertion error if no username is provided. I think this should just return false (or worst case, throw a regular LoginException) instead. I expect it to be unusual that the username would be null, but if so, it's just a plain failed login, right?
The SQLLoginModule doesn't seem to check at all, and would throw a NullPointerException if the user was null. Whatever we decide on the other one, we should do it here too.