Subject passed in by the Callback implementations overwrites any existing Subject.

It should be a merge if there is already an authenticated Subject present via SecurityContext.getAuthenticatedSubject()