public Session getSession(boolean create) {
        if (LOGGER.isTraceEnabled()) {
            LOGGER.trace("attempting to get session; create = " + create
                    + "; session is null = " + (this.session == null)
                    + "; session has id = " + (this.session != null && session.getId() != null));
        }

        if (this.session == null && create) {

            //added in 1.2:
            if (!isSessionCreationEnabled()) {
                String msg = "Session creation has been disabled for the current subject.  This exception indicates "
                        + "that there is either a programming error (using a session when it should never be "
                        + "used) or that Shiro's configuration needs to be adjusted to allow Sessions to be created "
                        + "for the current Subject.  See the " + DisabledSessionException.class.getName() + " JavaDoc "
                        + "for more.";
                throw new DisabledSessionException(msg);
            }

            LOGGER.trace("Starting session for host {}", getHost());
            SessionContext sessionContext = createSessionContext();
            Session session = this.securityManager.start(sessionContext);
            this.session = decorate(session);
        }
        return this.session;
    }
Returns {@code true} if this Subject is allowed to create sessions, {@code false} otherwise.

@return {@code true} if this Subject is allowed to create sessions, {@code false} otherwise.
@since 1.2
core/src/main/java/org/apache/shiro/subject/support/DelegatingSubject.java