code: public Enumeration getAttributeNames() {
          Enumeration attrNameEnum;
          if (!_hasSecurityInfo) {
              attrNameEnum = super.getAttributeNames();
          } else {
              String[] attrNames = getValueNames();
              attrNameEnum = new ArrayEnumeration(attrNames);
          }
          return attrNameEnum;
      }
docs: /*
  @see javax.servlet.http.HttpSession#getAttributeNames()