Ревью: логирование входа на Java

public boolean login(String username, String password, HttpServletRequest req) {
    log.info("Login attempt: user=" + username + " password=" + password);
    User u = users.find(username);
    if (u == null || !encoder.matches(password, u.getHash())) {
        log.debug("failed");
        return false;
    }
    log.info("Session " + req.getSession().getId() + " created for " + username
        + " card=" + u.getCardNumber() + " ua=" + req.getHeader("User-Agent"));
    return true;
}