protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        //false by default or we wouldn't be in this method
        boolean loggedIn = false;
        if (isLoginAttempt(request, response)) {
            loggedIn = executeLogin(request, response);
        }
        if (!loggedIn) {
            sendChallenge(request, response);
        }
        return loggedIn;
    }
Processes unauthenticated requests. It handles the two-stage request/challenge authentication protocol.

@param request  incoming ServletRequest
@param response outgoing ServletResponse
@return true if the request should be processed; false if the request should not continue to be processed
web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java