Of course you can store login data in database, however this still fails to address the user<->data matching issue, unless you develop your own matching mechanism. And IMHO it`s not a good idea. By the time when I was using PHP, I already tried storing session data in DBMS in order to achieve cross-server session synchronization, and it does not scale well.
As for the Facade application that handles authentication....that`s nice. In fact, that appears to be how will single sign-on look like with web services(theserverside.com has an article on this). But I don`t think this may be a solution for those who uses application server`s security model. It`s strange that servlet spec does not bring up this issue