// attempt to access an unprotected resource that is not the
// j_security_check.
// if we are logged in, return the logged in principal.
if (request != null) {
// null response appears to prevent redirect to login page
Principal user = authenticator.authenticate(realm, pathInContext,
request, null);
if (user == null || user == SecurityHandler.__NOBODY) {
//TODO use run-as as nextCaller if present
ContextManager.setCallers(defaultPrincipal.getSubject(), defaultPrincipal.getSubject());
request.setUserPrincipal(new NotChecked());