code: protected void dispatch(String pathInContext,
                              HttpServletRequest request,
                              HttpServletResponse response,
                              ServletHolder servletHolder, 
                              int type)
          throws ServletException, UnavailableException, IOException
      {
          if (type == Dispatcher.__REQUEST)
          {
              // This is NOT a dispatched request (it it is an initial request)
              ServletHttpRequest servletHttpRequest= (ServletHttpRequest)request;
              ServletHttpResponse servletHttpResponse= (ServletHttpResponse)response;  
              
              // protect web-inf and meta-inf
              if (StringUtil.startsWithIgnoreCase(pathInContext, "/web-inf") || StringUtil.startsWithIgnoreCase(pathInContext, "/meta-inf"))
              {
                  response.sendError(HttpResponse.__404_Not_Found);
                  return;
              }
              
              // Security Check
              if (!getHttpContext().checkSecurityConstraints(
                              pathInContext,
                              servletHttpRequest.getHttpRequest(),
                              servletHttpResponse.getHttpResponse()))
                  return;
          }
          else
          {
              // This is a dispatched request.
              
              // Handle dispatch to j_security_check
              HttpContext context= getHttpContext();
              if (context != null
                      && context instanceof ServletHttpContext
                      && pathInContext != null
                      && pathInContext.endsWith(FormAuthenticator.__J_SECURITY_CHECK))
              {
                  ServletHttpRequest servletHttpRequest=
                      (ServletHttpRequest)context.getHttpConnection().getRequest().getWrapper();
                  ServletHttpResponse servletHttpResponse= servletHttpRequest.getServletHttpResponse();
                  ServletHttpContext servletContext= (ServletHttpContext)context;
                  
                  if (!servletContext.jSecurityCheck(pathInContext,servletHttpRequest.getHttpRequest(),servletHttpResponse.getHttpResponse()))
                      return;
              }
          }
          
          // Build and/or cache filter chain
          FilterChain chain=null;
          if (pathInContext != null) {
              chain = getChainForPath(type, pathInContext, servletHolder);
          } else {
              chain = getChainForName(type, servletHolder);
          }
  
          if (log.isDebugEnabled()) log.debug("chain="+chain);
          
          // Do the handling thang
          if (chain!=null)
              chain.doFilter(request, response);
          else if (servletHolder != null)
              servletHolder.handle(request, response);    
          else // Not found
              notFound(request, response);
      }
docs: /* ------------------------------------------------------------