@SuppressWarnings({"unchecked"})
    protected SubjectContext resolveSession(SubjectContext context) {
        if (context.resolveSession() != null) {
            LOGGER.debug("Context already contains a session.  Returning.");
            return context;
        }
        try {
            //Context couldn't resolve it directly, let's see if we can since we have direct access to
            //the session manager:
            Session session = resolveContextSession(context);
            if (session != null) {
                context.setSession(session);
            }
        } catch (InvalidSessionException e) {
            LOGGER.debug("Resolved SubjectContext context session is invalid.  Ignoring and creating an anonymous "
                    + "(session-less) Subject instance.", e);
        }
        return context;
    }
Attempts to resolve any associated session based on the context and returns a
context that represents this resolved {@code Session} to ensure it may be referenced if necessary by the
invoked {@link SubjectFactory} that performs actual {@link Subject} construction.
<p/>
If there is a {@code Session} already in the context because that is what the caller wants to be used for
{@code Subject} construction, or if no session is resolved, this method effectively does nothing
returns the context method argument unaltered.

@param context the subject context data that may resolve a Session instance.
@return The context to use to pass to a {@link SubjectFactory} for subject creation.
@since 1.0
core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java