code: private String processURL(String url, HttpServletRequest req, HttpServletResponse res) {
          String serviceURL = url;
          int start = url.indexOf("${");
          int end = url.indexOf("}", start);
          if (end != -1) {
              String prop = url.substring(start + 2, end).trim();
              // no matter what we will remove the ${}
              // default to blank like the JSP EL
              String replace = "";
              if (REMOTE_USER.equals(prop)) {
                  if (req.getRemoteUser() != null) replace = req.getRemoteUser();
              }
              if (prop.toLowerCase().startsWith("session.")) {
                  String sessionKey = prop.substring("session.".length(), prop.length());
                  if (req.getSession().getAttribute(sessionKey) != null) {
                      // force to a string
                      replace = req.getSession().getAttribute(sessionKey).toString();
                  }
              }
              serviceURL = serviceURL.substring(0, start) +
                      replace +
                      serviceURL.substring(end + 1, serviceURL.length());
          }
          // call recursively to process more than one instance of a ${ in the serviceURL
          if (serviceURL.indexOf("${") != -1) serviceURL = processURL(serviceURL, req, res);
          return serviceURL;
      }
docs: /* Allow for a EL style replacements in the serviceURL
  
  The constant REMOTE_USER will replace the contents of ${REMOTE_USER}
  with the return value of request.getRemoteUserver() if it is not null
  otherwise the ${REMOTE_USER} is replaced with a blank.
  
  If you use ${session.somekey} the ${session.somekey} will be replaced with
  the String value of the session varialble somekey or blank if the session key
  does not exist.