* not proceed, e.g. redirect. <code>SecurityConstraint.__NOBODY</code> if
* security checking should not proceed and servlet handling should proceed,
* e.g. login page.
*/
private Principal obtainUser(String pathInContext, HttpRequest request, HttpResponse response) throws IOException, IOException {
ServletHttpRequest servletHttpRequest = (ServletHttpRequest) request.getWrapper();
WebResourcePermission resourcePermission = new WebResourcePermission(servletHttpRequest);
WebUserDataPermission dataPermission = new WebUserDataPermission(servletHttpRequest);
boolean unauthenticated = !(checked.implies(resourcePermission) || checked.implies(dataPermission));
boolean forbidden = excludedPermissions.implies(resourcePermission) || excludedPermissions.implies(dataPermission);