docs: public void optionallyAuthenticateUnprotectedResource(WebRequest webRequest) {
          if (webAppSecConfig.isUseAuthenticationDataForUnprotectedResourceEnabled() &&
              (unprotectedResource(webRequest) == PERMIT_REPLY) &&
              needToAuthenticateSubject(webRequest)) {
              webRequest.disableFormLoginRedirect();
              setAuthenticatedSubjectIfNeeded(webRequest);
          }
      }