realm always checked?

[Kyle F. Downey]

Quick question: why does Catalina check with the Realm implementation on
every HTTP request, even after a successful authentication? Is it the
responsibility of the Realm to handle caching and expiring of credentials?
Seems to me that would lead to a good bit of replication of code among
Realm implementations.

Also, would there be any objection to my factoring out common functions
from MemoryRealm, JDBCRealm and JAASRealm into an "AbstractRealm" helper class?
There's a lot of cut-and-pasting to do when writing a Realm right now. I
can post said class for review, since I am not a committer.

--kd