Identity identity = getIdentity();
DefaultLoginCredentials creds = extractCredentials(request);
if (creds.getCredential() != null && this.forceReAuthentication) {
identity.logout();
creds = extractCredentials(request);
}
if (isProtected(request) && !identity.isLoggedIn()) {
// Force session creation