static boolean needToSendCredentials(CookieStore cookieStore, URI uri) {
    return getAuthCookie(cookieStore, uri) == null;
  }
This method always needs to be called within a doAs block so that the client's TGT credentials
can be read from the Subject.

@return Kerberos Challenge String.

@throws AuthenticationException on authentication errors.
druid-handler/src/java/org/apache/hadoop/hive/druid/security/DruidKerberosUtil.java