cldellow

From what I see, wp_authenticate is an extensibility point so you can implement a filter that will manipulate the username/password provided.

wp_login is invoked 9 lines below the call to the wp_authenticate filter in wp-login.php.