code: protected void updateSessionLastAccessTime(Subject subject) {
  //        if (!isHttpSessions()) { //'native' sessions
              //Subject subject = SecurityUtils.getSubject();
              //Subject should never _ever_ be null, but just in case:
              if (subject != null) {
                  Session session = subject.getSession(false);
                  if (session != null) {
                      try {
                          session.touch();
                      } catch (Throwable t) {
  //                        log.error("session.touch() method invocation has failed.  Unable to update" +
  //                                "the corresponding session's last access time based on the incoming request.", t);
                      }
                  }
              }
  //        }
      }
docs: Updates any 'native'  Session's last access time that might exist to the timestamp when this method is called.
  If native sessions are not enabled (that is, standard Servlet container sessions are being used) or there is no
  session ({@code subject.getSession(false) == null}), this method does nothing.
  <p/>This method implementation merely calls
  <code>Session.{@link org.apache.shiro.session.Session#touch() touch}()</code> on the session.
  
  @param request  incoming request - ignored, but available to subclasses that might wish to override this method
  @param response outgoing response - ignored, but available to subclasses that might wish to override this method
  @since 1.0