Jersey Producing media type conflict

I'm trying out Jersey at the moment, followed this link to set up a web service in netbeans. I have my entities classes and my REST classes. It works to add, edit, delete, request objects (in this case Users objects) from a javafx2 client.

However, now I try to add a new method to my webservice for some simple authentication. First I added a new named query (Users.login) in the Users.java file:

@NamedQueries({
    @NamedQuery(name = "Users.findAll", query = "SELECT u FROM Users u"),
    @NamedQuery(name = "Users.login", query = "SELECT u FROM Users u WHERE u.username = :username AND u.password = :password"),
    @NamedQuery(name = "Users.findById", query = "SELECT u FROM Users u WHERE u.id = :id"),
    @NamedQuery(name = "Users.findByUserlevel", query = "SELECT u FROM Users u WHERE u.userlevel = :userlevel"),
    @NamedQuery(name = "Users.findByDisabled", query = "SELECT u FROM Users u WHERE u.disabled = :disabled")
})

Afterwards I added following code to my UsersFacadeREST.java file (generated by Netbeans 7.2):

@GET
@Path("{username}/{password}")
@Produces({"application/xml", "application/json"})
public Users login(@PathParam("username") String username, @PathParam("password") String password) {
    return em.createNamedQuery("login", Users.class)
            .setParameter("username", username)
            .setParameter("password", password)
            .getSingleResult();
}

However, I receive following error when trying to deploy the web service:

SEVERE: Producing media type conflict. The resource methods public entities.Users service.UsersFacadeREST.login(java.lang.String,java.lang.String) and public java.util.List service.UsersFacadeREST.findRange(java.lang.Integer,java.lang.Integer) can produce the same media type

As I'm new to this, I have no clue why the login() method is giving a conflict with findRange()? The first has 2 String parameters and give a Users object, the second has 2 integer parameters and returns a List object? Is there any way to fix this problem as I'm gonna need some custom queries added to my webservice...

For completion:

@GET
@Path("{from}/{to}")
@Produces({"application/xml", "application/json"})
public List<Users> findRange(@PathParam("from") Integer from, @PathParam("to") Integer to) {
    return super.findRange(new int[]{from, to});
}

Code in super class (AbstractFacade.java)

public List<T> findRange(int[] range) {
    javax.persistence.criteria.CriteriaQuery cq = getEntityManager().getCriteriaBuilder().createQuery();
    cq.select(cq.from(entityClass));
    javax.persistence.Query q = getEntityManager().createQuery(cq);
    q.setMaxResults(range[1] - range[0]);
    q.setFirstResult(range[0]);
    return q.getResultList();
}

The problem is, both methods are using path templates that match the same URIs. "{a}/{b}" is equivalent to "{c}/{d}" - in the same way "{username}/{password}" is equivalent to "{from}/{to}". And because both methods also use the same media type, there is an ambiguity. You can fix this by using a regular expression in the path template to make it more specific. I.e. since "{from}/{to}" should always be numbers, you can disambiguate it by changing it like follows: "{from: [0-9]+}/{to: [0-9]+}".

Anyway, are you sure no user will pick plain numbers from username and password? Looks like in your case it would be much better to use different URI "sub-space" for each of the two resources. E.g.: login/{username}/{password} and ranges/{from}/{to}.

BUT, few points on the design:

It is a very bad idea to put passwords in the URI. Never ever do it! Look at some existing proven authentication schemes - don't try to reinvent the wheel.
Consider using query params for specifying ranges - e.g. if you have some collection resource (like "myapp.com/calendar/events") you can model ranges using query parameters - e.g. "myapp.com/calendar/events?from=xxx&to=yyy.