/*
* Check for the default/server-generated/unauthenticated
* security context.
*/
final SecurityContext securityContext = SecurityContext.getCurrent();
Subject subject = securityContext.didServerGenerateCredentials() ?
new Subject() : securityContext.getSubject();
if (subject == null) {
subject = new Subject();
}