code: @SuppressWarnings("unchecked")
      @Override
      protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
              throws AuthenticationException {
          String id;
  
          if (AnonymousToken.isAnonymous(token)) {
              // Only continue if an anonymous identity has been set
              if (_anonymousId != null) {
                  id = _anonymousId;
              } else {
                  return null;
              }
          } else {
              id = ((ApiKeyAuthenticationToken) token).getPrincipal();
          }
  
          return getUncachedAuthenticationInfoForKey(id);
      }
docs: Gets the AuthenticationInfo that matches a token.  This method is only called if the info is not already
  cached by the realm, so this method does not need to perform any further caching.