1) For starters log the values of password and username that you have retrieved from the database. They are an obvious mismatch from the input values thats why you are not being authenticated.
2) You are retrieving all the rows from your database table. Which means that even if your password and username is correct but there are more than one sets of correct username's and passwords your program has a high chance of not working.
So retrieve a row using the specific username in the WHERE clause. It will help.
3) Also preferred is that
you should log the values you have retrieved from the request scope by first reading them into a
string variable.