// second, perform descriptor actions
final Descriptor descriptor = Descriptor.getDescriptorSingleton();
if (descriptor != null) {
// map's the path if a mapping is specified in the descriptor
path = descriptor.mapPath(path);
}
// third, authenticate the user
final Subject user = authenticate(request, response);
if (user == null) {