raints 
 of any kind on that, the expectation is that Jakarta EE servers in practice will mainly look at the 
 result being <code>AuthStatus.SUCCESS</code> or not <code>AuthStatus.SUCCESS</code>. Simply said, if the result is 
 <code>AuthStatus.SUCCESS</code> the authenticated identity (if any) must be set (established) for the current HTTP request, 
 otherwise not.
 
 <p>
 The return value of <a href="../../../jakarta/security/enterprise/SecurityContext.html#authenticate-jakarta.servlet.http.HttpServletReq