docs: protected void checkSecurity(SessionData s, HttpServletRequest req)
    {
      if (com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled() && LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
      {
        LoggingUtil.SESSION_LOGGER_CORE.entering(methodClassName, methodNames[CHECK_SECURITY]);
      }
  
      String auth = null;
      String owner = s.getUserName();
  
      if ((CollaboratorHelperImpl.getCurrentSecurityCollaborator(s.getServletContext()) != null)  &&
          (WSSecurityHelper.isServerSecurityEnabled()))
      {
        if (com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled()&&LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
        {
            LoggingUtil.SESSION_LOGGER_CORE.logp(Level.FINE, methodClassName, methodNames[CHECK_SECURITY], "calling getUser");
        }
        auth = getUser();
      }
      else
      {
        if (com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled()&&LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
        {
            LoggingUtil.SESSION_LOGGER_CORE.logp(Level.FINE, methodClassName, methodNames[CHECK_SECURITY], "calling getRemoteUser");
        }
        auth = req.getRemoteUser();
      }
      if (auth == null)
      {
        auth = MemoryStore.ANONYMOUS_USER;
      }
      // the request comes in under an authentication that's different
      // than who created and/or currently owns the session
      if (auth!=null && owner!=null && !((_smc.getSecurityUserIgnoreCase() && auth.equalsIgnoreCase(owner)) || auth.equals(owner))) 
      {
        // PM04304: if SecurityUserIgnoreCase is enabled then compare author and owner ignoring case
        // a user who created a session while unauthenticated
        // has now been authenticated
        // change the owner of the session
        if (owner.equals(MemoryStore.ANONYMOUS_USER))
        {
          s.setUser(auth);
        }
        else
        {
          // a session owned by an authenticated user is accessed
          // with the wrong authentication
          if (!((IExtendedRequest) req).getRunningCollaborators())
          {
            // only throw this exception if we're NOT running collaborators...
            // collaborators will be treated as trusted system code, so they will
            // get the session even if security integration check fails.
            Object params[] = { auth, owner };
            if (!_smc.getInvalidateOnUnauthorizedSessionRequestException()) { //PM93356 (SCWI 105957) only log if InvalidateOnUnauthorizedSessionRequestException is not set
                LoggingUtil.SESSION_LOGGER_CORE.logp(Level.SEVERE, methodClassName, methodNames[CHECK_SECURITY], "SessionContext.unauthAccessError", params);
            }
            UnauthorizedSessionRequestException usre;
            ResourceBundle rb = LoggingUtil.SESSION_LOGGER_CORE.getResourceBundle();
            if (rb != null)
            {
              String msg = MessageFormat.format(rb.getString("SessionContext.unauthAccessError"), params);
              usre = new UnauthorizedSessionRequestException(msg);
            }
            else
            {
              usre = new UnauthorizedSessionRequestException();
            }
            //I believe that this should be true for all requests, but since it is being added for an apar, 712446, I will only add it around the custom property
            if (!_smc.getThrowSecurityExceptionOnGetSessionFalse() && !_smc.getInvalidateOnUnauthorizedSessionRequestException()) {
                s.getISession().decrementRefCount();
            }
            throw usre;
          }
        }
      }
      if (com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled() && LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
      {
        LoggingUtil.SESSION_LOGGER_CORE.exiting(methodClassName, methodNames[CHECK_SECURITY]);
      }
    }