public static boolean isInvalidStanzaSentPriorToResourceBinding(final Packet stanza, final ClientSession session)
    {
        // Openfire sets 'authenticated' only after resource binding.
        if (session.getStatus() == Session.Status.AUTHENTICATED) {
            return false;
        }

        // Beware, the 'to' address in the stanza will have been overwritten by the
        final JID intendedRecipient = stanza.getTo();
        final JID serverDomain = new JID(XMPPServer.getInstance().getServerInfo().getXMPPDomain());

        // If there's no 'to' address, then the stanza is implicitly addressed at the user itself.
        if (intendedRecipient == null) {
            return false;
        }

        // TODO: after authentication (but prior to resource binding), it should be possible to verify that the
        // intended recipient's bare JID corresponds with the authorized user. Openfire currently does not have an API
        // that can be used to obtain the authorized username, prior to resource binding.

        if (intendedRecipient.equals(serverDomain)) {
            return false;
        }

        return true;
    }
@Test
    public void testIsInvalid_addressedAtDomain_unauthenticated() throws Exception
    {
        // Setup test fixture.
        final Packet stanza = new Message();
        stanza.setTo(XMPPServer.getInstance().getServerInfo().getXMPPDomain());
        final LocalClientSession session = mock(LocalClientSession.class, withSettings().strictness(Strictness.LENIENT));
        when(session.getStatus()).thenReturn(Session.Status.CONNECTED); // Openfire sets 'AUTHENTICATED' only after resource binding has been done.

        // Execute system under test.
        final boolean result = SessionPacketRouter.isInvalidStanzaSentPriorToResourceBinding(stanza, session);

        // Verify results.
        assertFalse(result);
    }