d.
 The Authenticator object, which must be created by the caller,
 is used indirectly to check access permission.  The Authenticator
 object passed in when the session is created is compared with
 the Authenticator object passed in to subsequent requests to
 get the default session.  If both objects are the same, or are
 from the same ClassLoader, the request is allowed.  Otherwise,
 it is denied.  <p>

 Note that if the Authenticator object used to create the session
 is null, anyone can get the default s