void addInternalServlet(String pathSpec, ServletHolder holder, boolean requireAuthz) {
    if (authenticationEnabled && requireAuthz) {
      FilterHolder filter = new FilterHolder(AdminAuthorizedFilter.class);
      filter.setName(AdminAuthorizedFilter.class.getSimpleName());
      FilterMapping fmap = new FilterMapping();
      fmap.setPathSpec(pathSpec);
      fmap.setDispatches(FilterMapping.ALL);
      fmap.setFilterName(AdminAuthorizedFilter.class.getSimpleName());
      webAppContext.getServletHandler().addFilter(filter, fmap);
    }
    webAppContext.getSessionHandler().getSessionCookieConfig().setHttpOnly(true);
    webAppContext.getSessionHandler().getSessionCookieConfig().setSecure(true);
    webAppContext.addServlet(holder, pathSpec);
  }
Add an internal servlet in the server, specifying whether or not to protect with Kerberos
authentication. Note: This method is to be used for adding servlets that facilitate internal
communication and not for user facing functionality. For servlets added using this method,
filters (except internal Kerberos filters) are not enabled.
@param pathSpec     The path spec for the {@link Servlet}
@param holder       The object providing the {@link Servlet} instance
@param requireAuthz Require Kerberos authenticate to access servlet
hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java