}
// We have successfully authenticated ...
try {
// Look for whether this context is read-only ...
SecurityContext securityContext = sessionContext.getSecurityContext();
boolean writable = JcrSession.hasRole(securityContext, ModeShapeRoles.READWRITE, repoName, workspaceName)
|| JcrSession.hasRole(securityContext, ModeShapeRoles.ADMIN, repoName, workspaceName);
JcrSession session = null;
if (running.useXaSessions()) {
session = new JcrXaSession(this, workspaceName, sessionContext, attributes, !writable);