shiro在jeesite中登录中的应用，我要在登录表单中传递参数，如何能在过滤器中传递验证

jeesite登录流程------》

一：

loginIndex.jsp 的登录表单提交------》FormAuthenticationFilter的createToken()方法，目的new UsernamePasswordToken()

protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
   String username = getUsername(request);
   String password = getPassword(request);
    String xx1 = request.getParameter("xx");
   if (password==null){
      password = "";
   }
   boolean rememberMe = isRememberMe(request);
   String host = StringUtils.getRemoteAddr((HttpServletRequest)request);
   String captcha = getCaptcha(request);
   boolean mobile = isMobileLogin(request);
   //return new UsernamePasswordToken(username, password.toCharArray(), rememberMe, host, captcha, mobile);
   return new UsernamePasswordToken(username, password.toCharArray(), rememberMe, host, captcha, mobile,xx1);
}

二：

---------------》SystemAuthorizingRealm 的doGetAuthenticationInfo（）,这里从上一步的UsernamePasswordToken类中取到表单的用户名，密码等，再从数据库取出用户名，密码进行比较验证

/**
 * 认证回调函数, 登录时调用
 */
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) {
   UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
   String xx1 = token.getXx();
   int activeSessionSize = getSystemService().getSessionDao().getActiveSessions(false).size();
   if (logger.isDebugEnabled()){
      logger.debug("login submit, active session size: {}, username: {}", activeSessionSize, token.getUsername());
   }
   
   // 校验登录验证码
   if (LoginController.isValidateCodeLogin(token.getUsername(), false, false)){
      Session session = UserUtils.getSession();
      String code = (String)session.getAttribute(ValidateCodeServlet.VALIDATE_CODE);
      if (token.getCaptcha() == null || !token.getCaptcha().toUpperCase().equals(code)){
         throw new AuthenticationException("msg:验证码错误, 请重试.");
      }
   }
   
   // 校验用户名密码
   User user = getSystemService().getUserByLoginName(token.getUsername());
   if (user != null) {
      if (Global.NO.equals(user.getLoginFlag())){
         throw new AuthenticationException("msg:该已帐号禁止登录.");
      }
      byte[] salt = Encodes.decodeHex(user.getPassword().substring(0,16));
      return new SimpleAuthenticationInfo(new Principal(user, token.isMobileLogin()), 
            user.getPassword().substring(16), ByteSource.Util.bytes(salt), getName());
   } else {
      return null;
   }
}

三：（二）中的验证如果失败，则执行FormAuthenticationFilter的onLoginFailure（）方法

/**
 * 登录失败调用事件
 */
@Override
protected boolean onLoginFailure(AuthenticationToken token,
      AuthenticationException e, ServletRequest request, ServletResponse response) {
   String className = e.getClass().getName(), message = "";
   if (IncorrectCredentialsException.class.getName().equals(className)
         || UnknownAccountException.class.getName().equals(className)){
      message = "用户或密码错误, 请重试.";
   }
   else if (e.getMessage() != null && StringUtils.startsWith(e.getMessage(), "msg:")){
      message = StringUtils.replace(e.getMessage(), "msg:"