public String login(ActionForm form, HttpServletRequest request, HttpServletResponse response, ActionMapping mapping)
			throws Exception {
		this.logout(form, request, response, mapping);
		if (logger.isDebugEnabled()) {
			logger.debug("login(username = " + request.getParameter("username") + ") - start");
		}
		Credentials credentials = new Credentials();
		super.valorize(form, credentials, request.getLocale());
		// valorize doesn't set the secret property due to overridden method
		credentials.setSecret(request.getParameter("secret"));
		User user = domain.login(credentials);
		if (user == null) {
			return "failure";
		} else {
			request.getSession().setAttribute(UserAction.SESSION_KEY, user);
			if (request.getParameter("remember") != null) {
				Cookie cookie = new Cookie("smartweb-auth", credentials.toString());
				cookie.setMaxAge(15 * 24 * 60 * 60);
				response.addCookie(cookie);
			}
			user.getPolicy();
			return "success";
		}
	}

	/**
	 * TODO documentation
	 * 
	 * @param form
	 * @param request
	 * @param response
	 * @param mapping
	 * @return
	 * @throws Exception
	 * @throws BusinessException
	 */
	public String autoLogin(ActionForm form, HttpServletRequest request, HttpServletResponse response,
			ActionMapping mapping) throws BusinessException {
		logger.info("autoLogin() - start");
		Cookie[] cookies = request.getCookies();
		for (int i = 0; i < cookies.length; i++) {
			Cookie cookie = cookies[i];
			if (cookie.getName().equals("smartweb-auth")) {
				String value = cookie.getValue();
				User user = null;
				try {
					user = domain.login(new Credentials(value));
				} catch (IOException e) {
					cookie.setMaxAge(0);
					response.addCookie(cookie);
				}
				if (user == null) {
					return "failure";
				} else {
					// renew the expire time
					request.getSession().setAttribute(UserAction.SESSION_KEY, user);
					cookie.setMaxAge(15 * 24 * 60 * 60);
					response.addCookie(cookie);
					return "success";
				}
			}
		}
		return "disabled";
	}

	/**
	 * TODO documentation
	 * 
	 * @param form
	 * @param request
	 * @param response
	 * @param mapping
	 * @return
	 * @throws BusinessException
	 */
	public String logout(ActionForm form, HttpServletRequest request, HttpServletResponse response,
			ActionMapping mapping) throws BusinessException {
		logger.info("logout() - start");
		domain.logout((User)request.getSession().getAttribute(UserAction.SESSION_KEY));

	public String onRegister(Map parameters, String step) throws Exception {
		// try to recover user from map
		String userId = (String)parameters.get(USER_ID_KEY);
		User user = null;
		if (userId != null && !userId.trim().equals("") && !userId.equals("0")) {
			user = domain.findUser(userId);
		}
		if (step.equals(STATE_START) || step.equals(STATE_REQUEST_INSERT))
			step = next(step);
		if (step.equals(STATE_INSERT_UPDATE)) {
			// FIXME only authorized people can update personal informations
			user = updateUser(parameters, user);
			return next(step);
		} else if (step.equals(STATE_SEND_MESSAGE)) {