new auth-method or forward j_security in Tomcat?

[jacksuyu]

Could I specify some new Auth-method? I want to check the http header.

Seems BASIC, DIGEST doesn't work at all, if I use FORM, I have to
redirect and put username password in the query string, which is not
secure.

Could I build my own auth-method?

Or if can't , can I forward for j_security with j_username and
j_password, so at least j_password won't go back to user's browser.

Thanks.