code: @Override
      public void postInvokeForSecureResponse(Object secObject) throws ServletException {
          try {
              if (jaccServiceRef.getService() != null) {
                  jaccServiceRef.getService().resetPolicyContextHandlerInfo();
              }
  
              if (secObject != null) {
                  WebSecurityContext webSecurityContext = (WebSecurityContext) secObject;
                  if (webSecurityContext.getJaspiAuthContext() != null &&
                      webAuthenticatorRef != null) {
                      WebAuthenticator jaspiService = webAuthenticatorRef.getService(JASPI_SERVICE_COMPONENT_NAME);
                      if (jaspiService != null) {
                          try {
                              ((JaspiService) jaspiService).postInvoke(webSecurityContext);
                          } catch (Exception e) {
                              throw new ServletException(e);
                          }
                      }
                  }
              }
          } finally {
              if (secObject != null) {
                  removeModuleMetaDataFromThreadLocal(secObject);
              }
          }
      }
docs: Restore the security context to what it looked like before the servlet
  dispatch. This method is always called if <code>preInovke</code> was
  called.
  
  @param secObject the cookie returned from preInvoke. This
  may be null if <code>preInvoke</code> exited with an
  exception or if no work was done.