public SecurityManager resolveSecurityManager() {
        SecurityManager securityManager = getSecurityManager();
        if (securityManager == null) {
            if (LOGGER.isDebugEnabled()) {
                LOGGER.debug("No SecurityManager available in subject context map.  "
                        + "Falling back to SecurityUtils.getSecurityManager() lookup.");
            }
            try {
                securityManager = SecurityUtils.getSecurityManager();
            } catch (UnavailableSecurityManagerException e) {
                if (LOGGER.isDebugEnabled()) {
                    LOGGER.debug("No SecurityManager available via SecurityUtils.  Heuristics exhausted.", e);
                }
            }
        }
        return securityManager;
    }
The session key that is used to store whether or not the user is authenticated.
core/src/main/java/org/apache/shiro/subject/support/DefaultSubjectContext.java