@Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        return super.isAccessAllowed(request, response, mappedValue)
                || (!isLoginRequest(request, response) && isPermissive(mappedValue));
    }
Determines whether the current subject should be allowed to make the current request.
<p/>
The default implementation returns <code>true</code> if the user is authenticated.  Will also return
<code>true</code> if the {@link #isLoginRequest} returns false and the &quot;permissive&quot; flag is set.

@return <code>true</code> if request should be allowed access
web/src/main/java/org/apache/shiro/web/filter/authc/AuthenticatingFilter.java