Erro nesse laço de repetição ele so esta pegando o primeiro valor do banco de dados

@Controller
// @RequestMapping("/login") public class LoginController extends HttpServlet {

private static final long serialVersionUID = 1L;
private String username;
private String password;

@Autowired
Usuarios usuarios;


HttpServletRequest request;
HttpServletResponse response;

public String getUsername() {
    return username;
}

public void setUsername(String username) {
    this.username = username;
}

public String getPassword() {
    return password;
}

public void setPassword(String password) {
    this.password = password;
}

@RequestMapping("/login")
public ModelAndView logins() {
    ModelAndView mv = new ModelAndView("/login");
    mv.addObject(new Documento());
    return mv;
}

@RequestMapping("/efetuaLogin")
public ModelAndView login(HttpServletRequest request, HttpServletResponse response) {

    boolean validacao = false;

    HttpSession sessao;

    List<Usuario> usuariosCadastrados = usuarios.lista();


    String username = request.getParameter("username");
    String password = request.getParameter("password");

    for (Usuario usuario : usuariosCadastrados) {

        String loginbd = usuario.getUsername();
        String senhabd = usuario.getPassword();

        System.out.println("username do Formulario...:" + loginbd);
        System.out.println("Senha do banco........:" + senhabd);
        System.out.println("Senha do Formulario...:" + password);
        System.out.println("username do Formulario...:" + username);

        if (username.equals(loginbd) && password.equals(senhabd)) {
            validacao = true;

        }
        if (validacao == true) {

            return new ModelAndView("/documentos");

        } else {
            return new ModelAndView("hello");

        }
    }
    return null;
}
}

@Service
public class LoginService {

@PersistenceContext
  private EntityManager em;

@Autowired
private Usuarios usuarios; 

public List<Usuario> lista() {
  return em.createQuery("select u from Usuario u", Usuario.class).getResultList();
}
}