code: public void optionallyAuthenticateUnprotectedResource(WebRequest webRequest) {
          if (webAppSecConfig.isUseAuthenticationDataForUnprotectedResourceEnabled() &&
              (unprotectedResource(webRequest) == PERMIT_REPLY) &&
              needToAuthenticateSubject(webRequest)) {
              webRequest.disableFormLoginRedirect();
              setAuthenticatedSubjectIfNeeded(webRequest);
          }
      }
docs: Authenticate the request if the following conditions are met:
  1. Persist cred is enabled (a.k.a. use authentication data for unprotected resource)
  2. We have authentication data
  3. The resource is unprotected (if its protected, will authenticate after this)
  
  @param webRequest