@Override
    protected boolean onAccessDenied(final ServletRequest servletRequest,
                                     final ServletResponse servletResponse) throws Exception {
        HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
        if (StringUtils.equals(HttpMethod.OPTIONS.name(), httpServletRequest.getMethod())) {
            return true;
        }
        
        String tokenValue = getTokenValue(httpServletRequest);
        if (StringUtils.isBlank(tokenValue)) {
            LOG.error("token is null.");
            unionFailResponse(servletResponse);
            return false;
        }
        
        BearerToken token = new BearerToken(tokenValue);
        
        Subject subject = getSubject(servletRequest, servletResponse);
        
        try {
            subject.login(token);
        } catch (Exception e) {
            LOG.error("token is warning. token : {}.", tokenValue, e);
            unionFailResponse(servletResponse);
            return false;
        }
        
        return true;
    }
@Test
    public void testOnAccessDenied() throws Exception {
        when(httpServletRequest.getMethod()).thenReturn(HttpMethod.OPTIONS.name());
        assertTrue(statelessAuthFilter.onAccessDenied(httpServletRequest, httpServletResponse));
    }