docs: public void postProgrammaticAuthenticate(final HttpServletRequest req, final HttpServletResponse resp, final AuthenticationResult authResult,
                                               final boolean alwaysSetCallerSubject, final boolean addSSOCookie) {
          if (System.getSecurityManager() == null) {
              setSubjectAndCookies(req, resp, authResult, alwaysSetCallerSubject, addSSOCookie);
          } else {
              AccessController.doPrivileged(new PrivilegedAction<Object>() {
  
                  @Override
                  public Object run() {
                      setSubjectAndCookies(req, resp, authResult, alwaysSetCallerSubject, addSSOCookie);
                      return null;
                  }
              });
          }
      }