code: public void throwExceptionIfAlreadyAuthenticate(HttpServletRequest req, HttpServletResponse resp, WebAppSecurityConfig config, String username) throws ServletException {
          Subject callerSubject = subjectManager.getCallerSubject();
          if (subjectHelper.isUnauthenticated(callerSubject))
              return;
          if (!config.getWebAlwaysLogin()) {
              AuthenticationResult authResult = new AuthenticationResult(AuthResult.FAILURE, username);
              authResult.setAuditCredType(req.getAuthType());
              authResult.setAuditCredValue(username);
              authResult.setAuditOutcome(AuditEvent.OUTCOME_FAILURE);
              Audit.audit(Audit.EventID.SECURITY_API_AUTHN_01, req, authResult, Integer.valueOf(HttpServletResponse.SC_UNAUTHORIZED));
              throw new ServletException("Authentication had been already established");
          }
          logout(req, resp, config);
      }
docs: This method throws an exception if the caller subject is already authenticated and
  WebAlwaysLogin is false. If the caller subject is already authenticated and
  WebAlwaysLogin is true, then it will logout the user.
  
  @throws IOException
  @throws ServletException