code: protected String getStoredToken(HttpServletRequest req) {
  		HttpSession session = req.getSession(false);
  		
  		if (session == null)
  			return null;
  		
  		return (String) session.getAttribute(ATR_SESSION_TOKEN);
  	}
docs: Returns the token previously associated with given request.
  Default implementation retrieves the token from user session.
  @param req HTTP request
  @return associated token