protected void rememberSerializedIdentity(Subject subject, byte[] serialized) {

        if (!WebUtils.isHttp(subject)) {
            if (LOGGER.isDebugEnabled()) {
                String msg = "Subject argument is not an HTTP-aware instance.  This is required to obtain a servlet "
                        + "request and response in order to set the rememberMe cookie. Returning immediately and "
                        + "ignoring rememberMe operation.";
                LOGGER.debug(msg);
            }
            return;
        }


        HttpServletRequest request = WebUtils.getHttpRequest(subject);
        HttpServletResponse response = WebUtils.getHttpResponse(subject);

        //base 64 encode it and store as a cookie:
        String base64 = Base64.encodeToString(serialized);

        //the class attribute is really a template for the outgoing cookies
        Cookie template = getCookie();
        Cookie cookie = new SimpleCookie(template);
        cookie.setValue(base64);
        cookie.saveTo(request, response);
    }
Base64-encodes the specified serialized byte array and sets that base64-encoded String as the cookie value.
<p/>
The {@code subject} instance is expected to be a {@link WebSubject} instance with an HTTP Request/Response pair
so an HTTP cookie can be set on the outgoing response.  If it is not a {@code WebSubject} or that
{@code WebSubject} does not have an HTTP Request/Response pair, this implementation does nothing.

@param subject    the Subject for which the identity is being serialized.
@param serialized the serialized bytes to be persisted.
web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java