docs: public AuthenticationResult authenticate(HttpServletRequest request) {
          HttpSession session = null;
          AuthenticationResult authResult = null;
          if (!HTTP_DONT_USE_SESSION && !m_dontUseSession) {
              try {
                  session = request.getSession();
                  if (session != null) {
                      if (session.isNew()) {
                          session.setMaxInactiveInterval(MAX_SESSION_INACTIVITY_SECONDS);
                      }
                      authResult = (AuthenticationResult )session.getAttribute(AUTH_USER_SESSION_KEY);
                  }
              } catch (Exception ex) {
                  //Use no session mode meaning whatever VMC sends as hashed password is used to authenticate.
                  session = null;
                  m_rate_limited_log.log(EstTime.currentTimeMillis(), Level.ERROR, ex, "Failed to get or create HTTP Session. authenticating user explicitely.");
              }
          }
          if (authResult == null) {
              authResult = getAuthenticationResult(request);
              if (!authResult.isAuthenticated()) {
                  if (session != null) {
                      session.removeAttribute(AUTH_USER_SESSION_KEY);
                  }
                  m_rate_limited_log.log("JSON interface exception: " + authResult.m_message, EstTime.currentTimeMillis());
              } else {
                  if (session != null) {
                      //Cache the authResult in session so we dont authenticate again.
                      session.setAttribute(AUTH_USER_SESSION_KEY, authResult);
                  }
              }
          }
          return authResult;
      }