if (sc != null) {
subject = sc.getSubject();
}
} else {
SecurityContext sc = SecurityContext.getCurrent();
if (sc != null && !sc.didServerGenerateCredentials()) {
// make sure we don't use default unauthenticated subject,
// so that module cannot change this important (constant)
// subject.
subject = sc.getSubject();
}