docs: public boolean authorize(AuthenticationResult authResult, String appName, String uriName, Subject previousCaller, List<String> requiredRoles) {
          // Set the authorized subject on the thread
          subjectManager.setCallerSubject(authResult.getSubject());
          boolean isAuthorized = authorize(authResult, appName, uriName, requiredRoles);
          if (isAuthorized) {
              // at this point set invocation subject = caller subject.
              // delegation may change the invocation subject later
              subjectManager.setInvocationSubject(authResult.getSubject());
          } else {
              subjectManager.setCallerSubject(previousCaller);
          }
          return isAuthorized;
      }