code: public WebReply performInitialChecks(WebRequest webRequest, String uriName) {
          WebReply webReply = null;
          HttpServletRequest req = webRequest.getHttpServletRequest();
          String methodName = req.getMethod();
  
          if (uriName == null || uriName.length() == 0) {
              return new DenyReply("Invalid URI passed to Security Collaborator.");
          }
  
          if (unsupportedAuthMech() == true) {
              return new DenyReply("Authentication Failed : DIGEST not supported");
          }
  
          if (wasch.isSSLRequired(webRequest, uriName)) {
              return httpsRedirectHandler.getHTTPSRedirectWebReply(req);
          }
  
          webReply = unprotectedSpecialURI(webRequest, uriName, methodName);
          if (webReply != null) {
              return webReply;
          }
  
          webReply = unprotectedResource(webRequest);
          if (webReply == PERMIT_REPLY) {
              if (shouldWePerformTAIForUnProtectedURI(webRequest))
                  return null;
              else
                  return webReply;
          }
  
          return null;
      }
docs: Perform the preliminary checks to see if we should proceed to authentication
  and authorization.
  
  TODO: add authn/autz auditing for each of these cases
  
  These checks are, in order:
  <ol>
  <li>when uriName is null or empty, then return Deny</li>
  <li>if the challenge typs is DIGEST, then return Deny</li>
  <li>if the required roles is specified but empty, then return Deny</li>
  <li>if SSL is required but the request is not HTTPS, then return Redirect</li>
  <li>if the method is TRACE and there are no required roles, then return Deny</li>
  <li>if the security constraints in the dd are invalid, then return Deny</li>
  <li>if there are no required roles, then return Permit</li>
  <li>if Everyone is allowed, then return Permit</li>
  </ol>
  
  @param req the servlet request
  @param uriName the uri name of the request
  @return a WebReply if the request should be returned without authenticating/authorizing, otherwise null