docs: @Override
      public void saveContext(SecurityContext context, PortletRequestResponseHolder requestResponseHolder) {
          final Authentication authentication = context.getAuthentication();
          final PortletRequest request = requestResponseHolder.getRequest();
          PortletSession portletSession = request.getPortletSession(false);
  
          // See SEC-776
          if (authentication == null || authenticationTrustResolver.isAnonymous(authentication)) {
              if (logger.isDebugEnabled()) {
                  logger.debug("SecurityContext is empty or contents are anonymous - context will not be stored in PortletSession.");
              }
  
              if (portletSession != null) {
                  // SEC-1587 A non-anonymous context may still be in the session
                  portletSession.removeAttribute(springSecurityContextKey, this.sessionScope);
              }
              return;
          }
  
          if (portletSession == null) {
              portletSession = createNewSessionIfAllowed(context, requestResponseHolder);
          }
  
          // If PortletSession exists, store current SecurityContext but only if it has
          // actually changed in this thread (see SEC-37, SEC-1307, SEC-1528)
          if (portletSession != null) {
              // We may have a new session, so check also whether the context attribute is set SEC-1561
              if (contextChanged(context, requestResponseHolder) || portletSession.getAttribute(springSecurityContextKey, this.sessionScope) == null) {
                  portletSession.setAttribute(springSecurityContextKey, context, this.sessionScope);
  
                  if (logger.isDebugEnabled()) {
                      logger.debug("SecurityContext stored to PortletSession: '" + context + "'");
                  }
              }
          }
      }