public Optional<UserIdentity> loginWithRequestToken(final HttpServletRequest request) {
        if (userIdentityFactory.hasAuthenticationToken(request)) {
            return userIdentityFactory.getApiUserIdentity(request);
        } else {
            LOGGER.trace("No token on request. This is valid for API calls from the front-end");
            return Optional.empty();
        }
    }
This method attempts to get a token from the request headers and, if present, use that to login.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/OpenIdManager.java