as.setCurrentServlet(servletToInvoke);
createSession(request, as, servletToInvoke, subscriberURI);
SecurityInterceptor si = SecurityInterceptor.getInstance();
if (!si.verifyRequest(request, authModule, servletToInvoke)) {
return matched;
}
request.setRegion(info.getRoutingRegion());
// XXX why not set the subscriber URI here as well?
// is there really any use of setting the subscriberURI for error responses?