private void init(Supplier<byte[]> keySupplier) {
        DefaultWebSessionStorageEvaluator webEvaluator = new DefaultWebSessionStorageEvaluator();
        ((DefaultSubjectDAO) this.subjectDAO).setSessionStorageEvaluator(webEvaluator);
        this.sessionMode = HTTP_SESSION_MODE;
        setSubjectFactory(new DefaultWebSubjectFactory());
        setRememberMeManager(keySupplier == null ? new CookieRememberMeManager()
                : new CookieRememberMeManager(keySupplier));
        setSessionManager(new ServletContainerSessionManager());
        webEvaluator.setSessionManager(getSessionManager());
    }
@deprecated as of 1.2.  This should NOT be used for anything other than determining if the sessionMode has changed.
web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSecurityManager.java