code: private void createSubjectAndPushItOnThreadAsNeeded(HttpServletRequest req, HttpServletResponse res) {
          // We got a new instance of FormLogoutExtensionProcess every request.
          logoutSubject = null;
          Subject subject = subjectManager.getCallerSubject();
          if (subject == null || subjectHelper.isUnauthenticated(subject)) {
              if (authService == null && securityServiceRef != null) {
                  authService = securityServiceRef.getService().getAuthenticationService();
              }
              SSOAuthenticator ssoAuthenticator = new SSOAuthenticator(authService, null, null, ssoCookieHelper);
              //TODO: We can not call ssoAuthenticator.authenticate because it can not handle multiple tokens.
              //In the next release, authenticate need to handle multiple authentication data. See story
              AuthenticationResult authResult = ssoAuthenticator.handleSSO(req, res);
              if (authResult != null && authResult.getStatus() == AuthResult.SUCCESS) {
                  subjectManager.setCallerSubject(authResult.getSubject());
                  logoutSubject = authResult.getSubject();
              }
          }
      }
docs: For formLogout, this is a new request and there is no subject on the thread. A previous
  request handled on this thread may not be from this same client. We have to authenticate using
  the token and push the subject on thread so webcontainer can use the subject credential to invalidate
  the session.
  
  @param req
  @param res