    protected void sendResponse(HttpSession session, Subject subject, PrintWriter out) {

        String token = (String) session.getAttribute(LOGIN_TOKEN);

        if ( token == null) {
            byte[] seed = (subject.toString() + new Long(System.currentTimeMillis()).toString()).getBytes();
            SecureRandom random = new SecureRandom(seed);
            byte[] tokenBytes = new byte[128];
            random.nextBytes(tokenBytes);
            token = Base64.encodeBase64String(tokenBytes);
            session.setAttribute(LOGIN_TOKEN, token);
        }

        Map<String, String> answer = new HashMap<String, String>();
        answer.put("token", token);

        ServletHelpers.writeObject(converters, options, out, answer);
    }
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.