docs: public void unauthenticate(HttpServletRequest request) {
          if (HTTP_DONT_USE_SESSION) return;
          HttpSession session = request.getSession(false);
          if (session != null) {
              session.removeAttribute(AUTH_USER_SESSION_KEY);
              session.invalidate();
          }
      }