public String getUnauthorizedUrl() {
        return unauthorizedUrl;
    }
Returns the URL to which users should be redirected if they are denied access to an underlying path or resource,
or {@code null} if a raw {@link HttpServletResponse#SC_UNAUTHORIZED} response should be issued (401 Unauthorized).
<p/>
The default is {@code null}, ensuring default web server behavior.  Override this default by calling the
{@link #setUnauthorizedUrl(String) setUnauthorizedUrl} method with a meaningful path within your application
if you would like to show the user a 'nice' page in the event of unauthorized access.

@return the URL to which users should be redirected if they are denied access to an underlying path or resource,
or {@code null} if a raw {@link HttpServletResponse#SC_UNAUTHORIZED} response should be issued (401 Unauthorized).
web/src/main/java/org/apache/shiro/web/filter/authz/AuthorizationFilter.java