code: protected HttpSession createSession(final HttpServletRequest servletRequest) {
  
          LOGGER.debug("Returning an authenticated session in the default workspace");
          return  new HttpSession(repo.login(credentialsService.getCredentials(servletRequest)));
      }
docs: Create a JCR session for the given HTTP servlet request with a
  SecurityContext attached.
  
  @param servletRequest the servlet request
  @return a newly created JCR session