as kumar said, this could be a bug, so please file a report.
I just took a look at the form based authenticator. it gets the password as a String from a
parameter of the httpservletrequest, and then the realm calls String.getBytes() without
specifying a character set to use in the encoding. As such, the platform's default char set
is used in the encoding, which apparently does not match the charset used used by your
browser when you entered the password and it created the request.
Ron
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=274621