public void logout() {
        try {
            clearRunAsIdentitiesInternal();
            this.securityManager.logout(this);
        } finally {
            this.session = null;
            this.principals = null;
            this.authenticated = false;
            //Don't set securityManager to null here - the Subject can still be
            //used, it is just considered anonymous at this point.  The SecurityManager instance is
            //necessary if the subject would log in again or acquire a new session.  This is in response to
            //https://issues.apache.org/jira/browse/JSEC-22
            //this.securityManager = null;
        }
    }
Returns {@code true} if this Subject is allowed to create sessions, {@code false} otherwise.

@return {@code true} if this Subject is allowed to create sessions, {@code false} otherwise.
@since 1.2
core/src/main/java/org/apache/shiro/subject/support/DelegatingSubject.java