code: @Override
      public SecurityCookieImpl preInvoke(EJBRequestData request) throws EJBAccessDeniedException {
          Subject invokedSubject = subjectManager.getInvocationSubject();
          Subject callerSubject = subjectManager.getCallerSubject();
  
          EJBMethodMetaData methodMetaData = request.getEJBMethodMetaData();
  
          if (ejbSecConfig.getUseUnauthenticatedForExpiredCredentials()) {
              invokedSubject = setNullSubjectWhenExpired(invokedSubject);
              callerSubject = setNullSubjectWhenExpired(callerSubject);
          }
          Subject originalInvokedSubject = invokedSubject;
          Subject originalCallerSubject = callerSubject;
  
  //        SecurityCookieImpl securityCookie = new SecurityCookieImpl(invokedSubject, callerSubject);
          if (setUnauthenticatedSubjectIfNeeded(invokedSubject, callerSubject)) {
              invokedSubject = subjectManager.getInvocationSubject();
              callerSubject = subjectManager.getCallerSubject();
          }
          Subject subjectToAuthorize = (invokedSubject == null) ? callerSubject : invokedSubject;
  
          if (!isInternalUnprotectedMethod(methodMetaData)) {
              eah.authorizeEJB(request, subjectToAuthorize);
          }
  
          performDelegation(methodMetaData, subjectToAuthorize);
          subjectManager.setCallerSubject(subjectToAuthorize);
          SecurityCookieImpl securityCookie = new SecurityCookieImpl(originalInvokedSubject, originalCallerSubject, subjectManager.getInvocationSubject(), subjectToAuthorize);
          return securityCookie;
      }
docs: {@inheritDoc}