@SuppressWarnings({"UnusedDeclaration"})
    protected ServletResponse prepareServletResponse(ServletRequest request, ServletResponse response, FilterChain chain) {
        ServletResponse toUse = response;
        if (!isHttpSessions() && (request instanceof ShiroHttpServletRequest)
                && (response instanceof HttpServletResponse)) {
            //the ShiroHttpServletResponse exists to support URL rewriting for session ids.  This is only needed if
            //using Shiro sessions (i.e. not simple HttpSession based sessions):
            toUse = wrapServletResponse((HttpServletResponse) response, (ShiroHttpServletRequest) request);
        }
        return toUse;
    }
Prepares the {@code ServletResponse} instance that will be passed to the {@code FilterChain} for request
processing.
<p/>
This implementation delegates to {@link #wrapServletRequest(javax.servlet.http.HttpServletRequest)}
only if Shiro-based sessions are enabled (that is, !{@link #isHttpSessions()}) and the request instance is a
{@link ShiroHttpServletRequest}.  This ensures that any URL rewriting that occurs is handled correctly using the
Shiro-managed Session's sessionId and not a servlet container session ID.
<p/>
If HTTP-based sessions are enabled (the default), then this method does nothing and just returns the
{@code ServletResponse} argument as-is, relying on the default Servlet Container URL rewriting logic.

@param request  the incoming ServletRequest
@param response the outgoing ServletResponse
@param chain    the Servlet Container provided {@code FilterChain} that will receive the returned request.
@return the {@code ServletResponse} instance that will be passed to the {@code FilterChain} during request processing.
@since 1.0
web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java