code: protected boolean alreadyLoggedIn(HttpRequestMessage httpRequest) {
  
          ResourceAddress localAddress = httpRequest.getLocalAddress();
          Subject subject = httpRequest.getSubject();
  
          Collection<String> requiredRoles = asList(localAddress.getOption(REQUIRED_ROLES));
          if  (requiredRoles == null || requiredRoles.size() == 0) {
              return true;
          }
          if (subject != null ) {
              Collection<String> authorizedRoles = getAuthorizedRoles(subject);
              return authorizedRoles.containsAll(requiredRoles);
          }
          return false;
      }
docs: A session is "already logged in" under either of these circumstances:
  <ol>
  <li>The login module chain has already been run successfully.</li>
  <li>The session's subject has all required roles (e.g. none for unprotected services)</li>
  </ol>
  
  @param session  the session that may or may not be already logged in
  @return true iff the session is "already logged in" as defined above.