protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        saveRequestAndRedirectToLogin(request, response);
        return false;
    }
This default implementation simply calls
{@link #saveRequestAndRedirectToLogin(ServletRequest, ServletResponse) saveRequestAndRedirectToLogin}
and then immediately returns <code>false</code>, thereby preventing the chain from continuing so the redirect may
execute.
web/src/main/java/org/apache/shiro/web/filter/authc/UserFilter.java