docs: public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException
  	{
  		servletRequest.setCharacterEncoding("UTF-8");
  		httpRequest.set(servletRequest);
  		httpResponse.set(servletResponse);
  
  		Request appRequest = null;
  		try
  		{
  //			String sessionToken = ServletSupport.getSessionTokenFromCookie(servletRequest);
  			String sessionToken = ServletSupport.getCookieValue(servletRequest, SESSION_TOKEN_KEY);
  			String userId = ServletSupport.getCookieValue(servletRequest, USER_ID_KEY);
  			if("".equals(sessionToken))
  			{
  				sessionToken = null;
  			}
  			if("".equals(userId))
  			{
  				userId = null;
  			}
   			if(accessManager != null) {
  				appRequest = accessManager.bindRequest(this);
  //				System.out.println("request bound!! " + appRequest);
  				Session session = appRequest.resolveSession(sessionToken, userId);
  			}
  
  			if (this.syncUserPrefs &&  appRequest.getTimesEntered() == 0)
  			{
  				//pass user preferences here
  				ServletSupport.importCookieValues(servletRequest,  appRequest.getUserSettings());
  				ServletSupport.exportCookieValues(servletResponse,  appRequest.getUserSettings(), "/", userPrefsMaxAge, Arrays.asList(new String[]{SESSION_TOKEN_KEY}));
  			}
  
  			//if a user logged in, the user id must be stored
  			if(userId == null)
  			{
  				User user = appRequest.getUser();
  				if(user != null)
  				{
  					storeSessionDataInCookie(USER_ID_KEY, user.getId(), servletResponse);
  				}
  			}
  
  			//role based access control
  	//		checkAccess(servletRequest,  appRequest);
  
  			//delegate request
  			chain.doFilter(servletRequest, servletResponse);
  		}
  		catch (Throwable t)//make sure user gets a controlled response
  		{
  			//is this the actual entry point or is this entry point wrapped?
  			if ( appRequest != null &&  appRequest.getTimesEntered() > 1)
  			{
  				//it's wrapped, so the exception must be thrown at the top entry point
  				ServletSupport.rethrow(t);
  			}
  			handleException(servletRequest, servletResponse, t);
  		}
  		finally
  		{
  /*			if(loggingEnabled)
  			{
  				application.log(new PageVisitLogEntry((HttpServletRequest) servletRequest));
  			}
  			application.releaseRequest();  */
  			if(accessManager != null) {
  				accessManager.releaseRequest();
  			}
  		}
  	}