However MyFormAuthenticator.java still parses this parameter
That's indeed not good, this piece of code should have been removed.