protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        if (isLoginRequest(request, response)) {
            return true;
        } else {
            Subject subject = getSubject(request, response);
            // If principal is not null, then the user is known and should be allowed access.
            return subject.getPrincipal() != null;
        }
    }
Returns <code>true</code> if the request is a
{@link #isLoginRequest(javax.servlet.ServletRequest, javax.servlet.ServletResponse) loginRequest} or
if the current {@link #getSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) subject}
is not <code>null</code>, <code>false</code> otherwise.

@return <code>true</code> if the request is a
{@link #isLoginRequest(javax.servlet.ServletRequest, javax.servlet.ServletResponse) loginRequest} or
if the current {@link #getSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) subject}
is not <code>null</code>, <code>false</code> otherwise.
web/src/main/java/org/apache/shiro/web/filter/authc/UserFilter.java