code: public static void initSecret(ServletContext ctx)
      {
          
          if(ctx == null)
          {
              throw new NullPointerException("ServletContext ctx");
          }
          
          if (log.isLoggable(Level.FINE))
          {
              log.fine("Storing SecretKey @ " + INIT_SECRET_KEY_CACHE);
          }
  
          // Create and store SecretKey on application scope
          String cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE);
          
          if(cache == null)
          {
              cache = ctx.getInitParameter(INIT_SECRET_KEY_CACHE.toLowerCase());
          }
          
          if (!"false".equals(cache))
          {
              String algorithm = findAlgorithm(ctx);
              // you want to create this as few times as possible
              ctx.setAttribute(INIT_SECRET_KEY_CACHE, new SecretKeySpec(
                      findSecret(ctx, algorithm), algorithm));
          }
  
          if (log.isLoggable(Level.FINE))
          {
              log.fine("Storing SecretKey @ " + INIT_MAC_SECRET_KEY_CACHE);
          }
          
          String macCache = ctx.getInitParameter(INIT_MAC_SECRET_KEY_CACHE);
          
          if(macCache == null)
          {
              macCache = ctx.getInitParameter(INIT_MAC_SECRET_KEY_CACHE.toLowerCase());
          }
          
          if (!"false".equals(macCache))
          {
              String macAlgorithm = findMacAlgorithm(ctx);
              // init mac secret and algorithm 
              ctx.setAttribute(INIT_MAC_SECRET_KEY_CACHE, new SecretKeySpec(
                      findMacSecret(ctx, macAlgorithm), macAlgorithm));
          }
      }
docs: Does nothing if the user has disabled the SecretKey cache. This is
  useful when dealing with a JCA provider whose SecretKey
  implementation is not thread safe.
  
  Instantiates a SecretKey instance based upon what the user has
  specified in the deployment descriptor.  The SecretKey is then
  stored in application scope where it can be used for all requests.