docs: @Override
      public Object preInvoke(HttpServletRequest req, HttpServletResponse resp, String servletName, boolean enforceSecurity) throws SecurityViolationException, IOException {
  
          Subject invokedSubject = subjectManager.getInvocationSubject();
          Subject receivedSubject = subjectManager.getCallerSubject();
  
          WebSecurityContext webSecurityContext = new WebSecurityContext(invokedSubject, receivedSubject);
          setUnauthenticatedSubjectIfNeeded(invokedSubject, receivedSubject);
  
          if (req != null) {
              SRTServletRequestUtils.setPrivateAttribute(req, SECURITY_CONTEXT, webSecurityContext);
          }
  
          if (enforceSecurity) {
              // Authentication and authorization are not required
              // for servlet init or destroy and, per spec, should
              // not be done for forward or include paths.
              if (req != null) {
                  performSecurityChecks(req, resp, receivedSubject, webSecurityContext);
              }
  
              if (req != null) {
                  extraAuditData.put("HTTP_SERVLET_REQUEST", req);
              }
              //auditManager.setHttpServletRequest(req);
  
              performDelegation(servletName);
  
              syncToOSThread(webSecurityContext);
          }
  
          return webSecurityContext;
      }