@Override
    protected void cleanup(ServletRequest request,
                           ServletResponse response, Exception existing) throws ServletException, IOException {
        if (existing instanceof UnauthenticatedException
                || (existing instanceof ServletException && existing.getCause() instanceof UnauthenticatedException)) {
            try {
                onAccessDenied(request, response);
                existing = null;
            } catch (Exception e) {
                existing = e;
            }
        }
        super.cleanup(request, response, existing);

    }
Overrides the default behavior to call {@link #onAccessDenied} and swallow the exception if the exception is
{@link UnauthenticatedException}.
web/src/main/java/org/apache/shiro/web/filter/authc/AuthenticatingFilter.java