数据库查询后验证无效

Question

有人可以告诉我这个验证在哪里出错，它不起作用。

@RequestMapping(value="/users", method = RequestMethod.POST)
public String loginForm(@ModelAttribute("users") Users users,
        @RequestParam("username") String username,
        @RequestParam("password") String password,
        Model model, 
        BindingResult result,Object obj, Errors errors,
        final RedirectAttributes redirectAttributes) throws Exception{

    if (result.hasErrors()) {
        return "loginForm";
    }
    Users user = pos.varifyUserNameAndPassword(username, password);
    if (! user.getUsername().equals(username)) {
         return "loginForm";
    }
    if (! user.getPassword().equals(password)){
        return "loginForm";
    }       
    model.addAttribute("users", users);
    model.addAttribute("categoryList",pos.listCategory());
    redirectAttributes.addFlashAttribute("message2", "Welcome " + username);
    return "redirect:/categories";
}

由于