code: public void handle(final HttpExchange pHttpExchange) throws IOException {
          try {
              checkAuthentication(pHttpExchange);
  
              Subject subject = (Subject) pHttpExchange.getAttribute(ConfigKey.JAAS_SUBJECT_REQUEST_ATTRIBUTE);
              if (subject != null)  {
                  doHandleAs(subject, pHttpExchange);
              }  else {
                  doHandle(pHttpExchange);
              }
          } catch (SecurityException exp) {
              sendForbidden(pHttpExchange,exp);
          }
      }
docs: Handle a request. If the handler is not yet started, an exception is thrown. If running with JAAS
  security enabled it will run as the given subject.
  
  @param pHttpExchange the request/response object
  @throws IOException if something fails during handling
  @throws IllegalStateException if the handler has not yet been started